Query for Users, Roles, AD Groups and Indexes.

[aknsun]

Hi,

I'm trying to get the query to pull out the following, but struggling a bit with all the joins. I need to get a list of the following in a report.

1. List of users
2. The Roles each user is part of.
3. The AD Group that each user is part of.
4. The Indexes that each user has access to.

Looks like I will need to be using the below 4 endpoints.

/services/authentication/users
/services/authorization/roles
/services/admin/LDAP-groups
/services/data/indexes

[harsmarvania57 · Accepted solution]

Hi,

Try below query on Search Head, not sure whether it will give you all information which you require. It is working fine in my lab environment (Which has very few users)

| rest splunk_server=local /services/authentication/users
| fields title, roles
| mvexpand roles
| append [ | rest splunk_server=local /services/authorization/roles
           | fields imported_roles,imported_srchIndexesAllowed,imported_srchIndexesDefault,srchIndexesAllowed,srchIndexesDefault,title
           | rename title as roles]
| append [ | rest splunk_server=local /services/admin/LDAP-groups
           | fields roles,title
           | rename title as ADGroup]
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(title) as userid, values(ADGroup) as ADGroup by roles
| mvexpand userid
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(roles) as roles, values(ADGroup) as ADGroup by userid

[sriniwf]

It's not working for our environment. Do we have any alternative query for this.

Actually in LDAP rest api query , we are only getting admin, user,power , splunk-system-user roles i'm getting.. Due to that, i'm not getting proper results.

can you please help me.

[aknsun]

HI @harsmarvania57. Thanks for the query. I had to make a small change to get it working by adding the following in the 3rd line

| rename title as userid

and including it in the stats