Splunk Search

Can we check App permission via Splunk logs

Naga
Engager

Here is the requirement:

I wanted to create a form with list of Apps in my Search head Dropdown. If the Developer choose any App from the list then it should show what level of permission (Read / Write) to whom in the dashboard. Is the App metadata writing this information anywhere in the logs. Or can we get this via REST API Search?

 

Sample Output

AppPermission
Dashboard ExamplesREAD - * ; WRITE - POWER
  

 

 

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @Naga ,

Check this:

| rest /services/apps/local 
| rename "eai:acl.perms.read" AS read, "eai:acl.perms.write" AS write 
| fields title label version read write
| strcat "READ - " read "; WRITE - " write permissions

 

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @Naga ,

Check this:

| rest /services/apps/local 
| rename "eai:acl.perms.read" AS read, "eai:acl.perms.write" AS write 
| fields title label version read write
| strcat "READ - " read "; WRITE - " write permissions

 

If this reply helps you, an upvote/like would be appreciated.

Naga
Engager

Thank you manjunath. It helped a lot. Can we get the same in internal logs? We have different search head and each set is owned by different teams like Team 1 Splunk Infra / Team 2 / Team 3. 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...