Splunk Search

How to Show how many users have access to an App?

SevenDos
Explorer

Hi all,

I'm trying to create a search that gives me back a table of all Apps and the amount of users that have access to it.

I can generate a list with all indexes and the amount of users that have access to it but I can't think of a way to do the same with Apps. I can generate who has accessed the app and when, but I can't seem to generate a list with the amount of users that have access to a specific app.

Anyone with an idea?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Start with this query to get a list of apps and the roles allowed to read (access) them.  An asterisk (*) means all roles have access.  Then cross-reference that with your list of roles and users with those roles.

| rest splunk_server=local /servicesNS/-/-/apps/local | search * | fields title eai:acl.perms.read
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...