Rest call to get list of all apps and join it with SAML groups

New Member


I'm using this search to join the apps with their respective SAML group roles


| rest /services/authentication/users splunk_server=local 
    | table defaultApp defaultAppSourceRole title roles 
    | rename defaultApp as splunk_app_name defaultAppSourceRole as defaultrole title as User
  | eval splunk_app_name= lower(splunk_app_name)
  | join defaultrole type=outer 
    [| rest /services/admin/SAML-groups 
    | table roles title id 
    | rename roles as defaultrole title as idm_role_name]
    |dedup splunk_app_name,id



The only issue is I'm not getting all of the apps with this rest call (probably 2/3rd of all apps)



| rest /services/authentication/users splunk_server=local 



I've tried using other calls like

  • | rest /services/authorization/roles
  • | rest /services/apps/local

but couldn't join them with SAML REST call

I need help finding a way to show all apps and then merge it with their SAML groups roles

Thank you

Labels (3)
Tags (5)
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...