Splunk Search

is there a way to search who has access to an index?

packet_hunter
Contributor

is there a way to search who has access to an index without having to dig thru the access controls, roles and users?

Thank you

1 Solution

somesoni2
Revered Legend

Not sure if this is what you're looking for. Below query gives the mapping of index with role which has access.

| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) 

This query extends the above solution and adds the users as well, so you get user, corresponding role and accessible indexes.

| rest /services/authentication/users splunk_server=local | table title roles | rename title as user | rename roles as title | mvexpand title  | join type=left max=0 title [| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) | table title indexes] 

View solution in original post

somesoni2
Revered Legend

Not sure if this is what you're looking for. Below query gives the mapping of index with role which has access.

| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) 

This query extends the above solution and adds the users as well, so you get user, corresponding role and accessible indexes.

| rest /services/authentication/users splunk_server=local | table title roles | rename title as user | rename roles as title | mvexpand title  | join type=left max=0 title [| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) | table title indexes] 

packet_hunter
Contributor

Thank you!

0 Karma

chris
Motivator

Wow thats a clever search, thank you

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...