Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Users with multiple roles - effective settings for...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
We are trying to organise some monitoring / Alerting for users and search disk usage and I know SplunkAdmins app has some stuff, but we need something a little different.
What I need atm is a way to determine a users effective settings as most users have at least 2 or more roles and I haven't found any clear way to determine what a given users allowance is to be able to configure an alert against.
Not sure if I have just missed something simple?
Hoping someone out there might have some suggestions.
Thanks in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have managed to work out this report which give me what I need:
| rest /services/authentication/users splunk_server=local
| fields title roles
| rename title as username
| mvexpand roles
| search roles IN (<Add role list here if you have limited number that provide functional access - or remove this like if you need to search all roles>)
| join type=left roles
[| rest /services/authorization/roles splunk_server=*search*
| rename title as roles
| table roles srchDiskQuota]
| sort username -srchDiskQuota
| eval CaptureDate = now()
| table username, srchDiskQuota, roles, CaptureDate
| inputlookup append=true ops_usersDiskQuota.csv
| dedup username
| outputlookup override_if_empty=false ops_usersDiskQuota.csv
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have managed to work out this report which give me what I need:
| rest /services/authentication/users splunk_server=local
| fields title roles
| rename title as username
| mvexpand roles
| search roles IN (<Add role list here if you have limited number that provide functional access - or remove this like if you need to search all roles>)
| join type=left roles
[| rest /services/authorization/roles splunk_server=*search*
| rename title as roles
| table roles srchDiskQuota]
| sort username -srchDiskQuota
| eval CaptureDate = now()
| table username, srchDiskQuota, roles, CaptureDate
| inputlookup append=true ops_usersDiskQuota.csv
| dedup username
| outputlookup override_if_empty=false ops_usersDiskQuota.csv
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
