List users belonging to a specific role

[annebeate]

Hi,

I would like to create a list of users belonging to a certain role using a saved search. Is this information available from one of the internal indexes?

Thanks in advance.

[jbsplunk · Accepted solution]

You can get this information from the rest endpoint on a per user basis, but I don't know of any way to query a role for its users. Take a look at:

https://splunkserver:8089/services/authentication/users

You should be able to get what you need from here.