Hi,
I'm using this search to join the apps with their respective SAML group roles
| rest /services/authentication/users splunk_server=local
| table defaultApp defaultAppSourceRole title roles
| rename defaultApp as splunk_app_name defaultAppSourceRole as defaultrole title as User
| eval splunk_app_name= lower(splunk_app_name)
| join defaultrole type=outer
[| rest /services/admin/SAML-groups
| table roles title id
| rename roles as defaultrole title as idm_role_name]
|dedup splunk_app_name,id
The only issue is I'm not getting all of the apps with this rest call (probably 2/3rd of all apps)
| rest /services/authentication/users splunk_server=local
I've tried using other calls like
but couldn't join them with SAML REST call
I need help finding a way to show all apps and then merge it with their SAML groups roles
Thank you