Splunk Cloud Platform

How to use Splunk REST API to create/update a role with more than 1 index access?

premrajvs
Explorer

I am trying to create roles via API and here is the curl request. Question I have is, I am not able to add more than 1 index to the srchIndexesAllowed field either when I create the role or when I update the role. I am not able to find any Splunk documentation around the request body.

Does anyone know how I can add/update multiple indexes for a role.

 

 

 

curl --location 'https://XXXXXXXXXXXXXXX/services/authorization/roles/fi_a00002-namespace_nonprod_power' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic XXXXXXXXXXXXXXXX' \
--data-urlencode 'imported_roles=user' \
--data-urlencode 'srchIndexesAllowed=index1,index2' \
--data-urlencode 'srchIndexesDefault=index1,index2'

 

 

 

Labels (1)
Tags (1)
0 Karma

jalecrim_decat
New Member

Trying the same here, getting an error while having the proper permissions:
{"messages":[{"type":"ERROR","text":"Current user doesn't have permission to add index test"}]}

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...