What is the best way to see all the role permissions assigned to each index?

[rbrisseyii]

I would like to see what role has access to each index without clicking through each role. Is there a search that can do this for me, or some other way to see all the roles assigned to each index?

[gjanders · Accepted solution]

I've added these to my app Alerts for SplunkAdmins:
SearchHeadLevel - Role access list by user
SearchHeadLevel - Index access list by user

Or github if you want just the searches

The only tweak to the accepted answer you might want to do is:

| rest /services/authorization/roles splunk_server="local" 
| table title, srchIndexesAllowed, srchIndexesDefault, imported_srchIndexesAllowed, imported_srchIndexesDefault
| rename title as roles

[sudosplunk]

Give this a try,

| rest /services/authorization/roles | table title srchIndexesAllowed

Use this if you're using search head clustering,

| rest /services/authorization/roles splunk_server=SHC_Captain | table title srchIndexesAllowed

[rbrisseyii]

Thanks, that worked great!

[sudosplunk]

Glad it worked for you. Can you accept the answer to close this thread. Thx!