Security

What is the best way to see all the role permissions assigned to each index?

rbrisseyii
Explorer

I would like to see what role has access to each index without clicking through each role. Is there a search that can do this for me, or some other way to see all the roles assigned to each index?

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

I've added these to my app Alerts for SplunkAdmins:
SearchHeadLevel - Role access list by user
SearchHeadLevel - Index access list by user

Or github if you want just the searches

The only tweak to the accepted answer you might want to do is:

| rest /services/authorization/roles splunk_server="local" 
| table title, srchIndexesAllowed, srchIndexesDefault, imported_srchIndexesAllowed, imported_srchIndexesDefault
| rename title as roles

View solution in original post

gjanders
SplunkTrust
SplunkTrust

I've added these to my app Alerts for SplunkAdmins:
SearchHeadLevel - Role access list by user
SearchHeadLevel - Index access list by user

Or github if you want just the searches

The only tweak to the accepted answer you might want to do is:

| rest /services/authorization/roles splunk_server="local" 
| table title, srchIndexesAllowed, srchIndexesDefault, imported_srchIndexesAllowed, imported_srchIndexesDefault
| rename title as roles

sudosplunk
Motivator

Give this a try,

| rest /services/authorization/roles | table title srchIndexesAllowed

Use this if you're using search head clustering,

| rest /services/authorization/roles splunk_server=SHC_Captain | table title srchIndexesAllowed

rbrisseyii
Explorer

Thanks, that worked great!

0 Karma

sudosplunk
Motivator

Glad it worked for you. Can you accept the answer to close this thread. Thx!

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...