Splunk Search

is there a way to search who has access to an index?

packet_hunter
Contributor

is there a way to search who has access to an index without having to dig thru the access controls, roles and users?

Thank you

1 Solution

somesoni2
Revered Legend

Not sure if this is what you're looking for. Below query gives the mapping of index with role which has access.

| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) 

This query extends the above solution and adds the users as well, so you get user, corresponding role and accessible indexes.

| rest /services/authentication/users splunk_server=local | table title roles | rename title as user | rename roles as title | mvexpand title  | join type=left max=0 title [| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) | table title indexes] 

View solution in original post

somesoni2
Revered Legend

Not sure if this is what you're looking for. Below query gives the mapping of index with role which has access.

| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) 

This query extends the above solution and adds the users as well, so you get user, corresponding role and accessible indexes.

| rest /services/authentication/users splunk_server=local | table title roles | rename title as user | rename roles as title | mvexpand title  | join type=left max=0 title [| rest /services/authorization/roles splunk_server=local | table title srchInd* | eval indexes=mvappend(srchIndexesAllowed,srchIndexesDefault) | table title indexes | mvexpand indexes | dedup title indexes | eval indexes_orig=indexes | join indexes max=0 type=left [| rest /services/data/indexes | stats count by title | table title| eval indexes=if(match(title,"^_"),"_*","*") | rename title as indexes_new]|  eval indexes=if(indexes_orig!=indexes_new,indexes_new, indexes_orig) | table title indexes] 

packet_hunter
Contributor

Thank you!

0 Karma

chris
Motivator

Wow thats a clever search, thank you

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...