Splunk Search

How to Generate Roles to Indexes table?

ttilstra1
Engager

I'm looking for a way to search all indexes available for each role in Splunk (including access inherited from other roles).

This search almost does this:

 

 

 

| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local | fields title,srchIndexesAllowed | rename srchIndexesAllowed as Indexes, title as Role | search Indexes=*

 

 

 

However, this does not account for inherited indexes.

Listing indexes available for a single role is fairly easy (but time consuming):

Under
Settings -> Roles -> 

Select a role (or Edit)
Open "Indexes" Tab
Filter "Show Selected" from the far right column.

-----------------------

Is there a way to get this list (for all roles) from SQL? 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

| rest /services/authentication/users splunk_server=local 
| table title roles 
| rename title as user 
| mvexpand roles 
| join type=left roles 
    [ rest /services/authorization/roles splunk_server=local 
    | table title srchIndexesAllowed srchIndexesDefault imported_srchIndexesAllowed imported_srchIndexesDefault 
    | rename title as roles] 
| fillnull value="" srchIndexesAllowed, srchIndexesDefault, imported_srchIndexesAllowed, imported_srchIndexesDefault 
| eval srchIndexesAllowed = srchIndexesAllowed + " " + imported_srchIndexesAllowed, srchIndexesDefault = srchIndexesDefault . " " . imported_srchIndexesDefault 
| makemv srchIndexesAllowed tokenizer=(\S+) 
| makemv srchIndexesDefault tokenizer=(\S+) 
| eval indexes= 
    [| eventcount summarize=false index=* index=_* 
    | stats values(index) AS indexes 
    | eval theindexes="\"" . mvjoin(indexes, " ") . "\"" 
    | return $theindexes ] 
| makemv indexes 
| stats values(srchIndexesAllowed) AS srchIndexesAllowed, values(srchIndexesDefault) AS srchIndexesDefault by roles
| where isnotnull(srchIndexesAllowed)

Thanx @gjanders for this!

You could also use app https://splunkbase.splunk.com/app/4111 to get this and other auth* stuff.

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

you could try this

| rest /services/authentication/users splunk_server=local 
| table title roles 
| rename title as user 
| mvexpand roles 
| join type=left roles 
    [ rest /services/authorization/roles splunk_server=local 
    | table title srchIndexesAllowed srchIndexesDefault imported_srchIndexesAllowed imported_srchIndexesDefault 
    | rename title as roles] 
| fillnull value="" srchIndexesAllowed, srchIndexesDefault, imported_srchIndexesAllowed, imported_srchIndexesDefault 
| eval srchIndexesAllowed = srchIndexesAllowed + " " + imported_srchIndexesAllowed, srchIndexesDefault = srchIndexesDefault . " " . imported_srchIndexesDefault 
| makemv srchIndexesAllowed tokenizer=(\S+) 
| makemv srchIndexesDefault tokenizer=(\S+) 
| eval indexes= 
    [| eventcount summarize=false index=* index=_* 
    | stats values(index) AS indexes 
    | eval theindexes="\"" . mvjoin(indexes, " ") . "\"" 
    | return $theindexes ] 
| makemv indexes 
| stats values(srchIndexesAllowed) AS srchIndexesAllowed, values(srchIndexesDefault) AS srchIndexesDefault by roles
| where isnotnull(srchIndexesAllowed)

Thanx @gjanders for this!

You could also use app https://splunkbase.splunk.com/app/4111 to get this and other auth* stuff.

r. Ismo 

ttilstra1
Engager

this works very well, thank you

ITWhisperer
SplunkTrust
SplunkTrust
| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local 
| eval srchIndexesAllowed=mvappend(srchInexesAllowed,imported_srchIndexesAllowed)
| fields title,srchIndexesAllowed
| rename srchIndexesAllowed as Indexes, title as Role
| search Indexes=*
0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...