How to search for which user has access to what index?

[splunkIT]

Does anyone know how to:

1) search for which user has what access to the index?
2) who has accessed to what index within like the last 24 hours?

[hexx · Accepted solution]

1) The following search will return a list of all known users as well as a semicolon-separated list of the indexes they have access to:


| rest /services/authentication/users
| rename title AS username roles AS role
| mvexpand role
| fields realname username role
| join type=outer role [
rest /services/authorization/roles
| rename title AS role | eval indexes=mvjoin(srchIndexesAllowed," ; ")
| fields role indexes]
| table realname username role indexes


A few caveats:

• You need to be admin to run this search
• Wildcards used to define list of indexes will not be expanded. "*" means "all non-internal indexes", "_*" means "all internal indexes".
• If you expect to return more than 1,000 users from your LDAP/AD groups, you might want to read this Splunk Answer.

2) This is a rather difficult mapping to establish as search strings are recorded without an expanded list of accessed indexes in the _audit events.

[claudio_manig]

Great thanks - i wonder why this isn't working though:

|rest /services/authentication/users splunk_server=local
|fields title roles realname
| mvexpand roles
| append [| rest /services/authorization/roles | table title srchIndexesAllowed
| rename title as roles
| mvexpand srchIndexesAllowed]
| stats list(*) as * by title, realname

Once i do the stats list i loos the srchIndexesAllowed column- any ideas?

[lassel]

I have the same question. I would be interested to know if the past two years has brought around a way to improve this answer?

A way to get the same information without using a rest call that only the admin can do.

[JohanDB]

Why not put the results in a csv?
Scheduled search could take care of this. The csv access can then be set to whatever you want.

[lassel]

And perhaps a way to expand the wildcards in indexes.