Splunk rest API (list all users)

[splunk_luis12]

Hi folks,

I'm tying to list all users from my Splunk cloud using this link:

https://docs.splunk.com/Documentation/SplunkCloud/latest/RESTREF/RESTaccess#authentication.2Fusers:~...

However I'm using a custom role who just have the following capabilities:

* admin_all_objects
* rest_access_server_endpoints
* rest_apps_management
* rest_apps_view
* rest_properties_get
*edit_user
*search

The user is unable to pull all users. My assumption is that as this users does not inheritance any other role then it is not able to list all users, as per the grantableRoles.

If I'm right, what chance do I have for this user to pull all users with the rest API? or what capabilities I'm missing?

Thanks in advance,

[splunk_luis12]

Hi @richgalloway I already tried with | rest /servicesNS/-/-/admin/users as well but I got the same result even using the admin_all_objects capability.

[richgalloway]

The admin_all_objects capability should be all you need.

Have you tried using servicesNS?

| rest /servicesNS/-/-/admin/users