Splunk Search

I need a search to find mapping of roles to AD Groups and indexes

nls7010
Path Finder

I have been able to find searches for roles mapped to AD Groups, but I need to get the indexes those roles are allowed to use.  I'm creating a search to assist in upgrading to a new system.  This mapping will give me the relationships.  I have used:

 | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but it only gives me the role and searchIndexes.  I need to map it to AD groups too.  Also, when I went to download that searches content, it did not download all the data.

I also used: | rest /services/admin/roles | table title, srchIndexesAllowed | rename title as role, but what I really need is all three values: Role mapped to AD Group and role mapped to indexes in the same search.

 

 

 

Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Not sure if it's what you're looking for, but try 

| rest /services/admin/LDAP-groups
---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...