Splunk Search

How to search for which user has access to what index?

splunkIT
Splunk Employee
Splunk Employee

Does anyone know how to:

1) search for which user has what access to the index?
2) who has accessed to what index within like the last 24 hours?

Tags (3)
1 Solution

hexx
Splunk Employee
Splunk Employee

1) The following search will return a list of all known users as well as a semicolon-separated list of the indexes they have access to:


| rest /services/authentication/users
| rename title AS username roles AS role
| mvexpand role
| fields realname username role
| join type=outer role [
rest /services/authorization/roles
| rename title AS role | eval indexes=mvjoin(srchIndexesAllowed," ; ")
| fields role indexes]
| table realname username role indexes

A few caveats:

  • You need to be admin to run this search
  • Wildcards used to define list of indexes will not be expanded. "*" means "all non-internal indexes", "_*" means "all internal indexes".
  • If you expect to return more than 1,000 users from your LDAP/AD groups, you might want to read this Splunk Answer.

2) This is a rather difficult mapping to establish as search strings are recorded without an expanded list of accessed indexes in the _audit events.

View solution in original post

hexx
Splunk Employee
Splunk Employee

1) The following search will return a list of all known users as well as a semicolon-separated list of the indexes they have access to:


| rest /services/authentication/users
| rename title AS username roles AS role
| mvexpand role
| fields realname username role
| join type=outer role [
rest /services/authorization/roles
| rename title AS role | eval indexes=mvjoin(srchIndexesAllowed," ; ")
| fields role indexes]
| table realname username role indexes

A few caveats:

  • You need to be admin to run this search
  • Wildcards used to define list of indexes will not be expanded. "*" means "all non-internal indexes", "_*" means "all internal indexes".
  • If you expect to return more than 1,000 users from your LDAP/AD groups, you might want to read this Splunk Answer.

2) This is a rather difficult mapping to establish as search strings are recorded without an expanded list of accessed indexes in the _audit events.

claudio_manig
Communicator

Great thanks - i wonder why this isn't working though:

|rest /services/authentication/users splunk_server=local
|fields title roles realname
| mvexpand roles
| append [| rest /services/authorization/roles | table title srchIndexesAllowed
| rename title as roles
| mvexpand srchIndexesAllowed]
| stats list(*) as * by title, realname

Once i do the stats list i loos the srchIndexesAllowed column- any ideas?

0 Karma

lassel
Communicator

I have the same question. I would be interested to know if the past two years has brought around a way to improve this answer?

A way to get the same information without using a rest call that only the admin can do.

0 Karma

JohanDB
Engager

Why not put the results in a csv?
Scheduled search could take care of this. The csv access can then be set to whatever you want.

0 Karma

lassel
Communicator

And perhaps a way to expand the wildcards in indexes.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...