srchFilter and inputlookup

[reubentrapdoor]

Is it possible to filter results in a lookup-file with filters defined in "srchFilter" in authorize.conf?

Example lookup:

[role-lookup.csv]
system,role
system01,linux
system02,linux
system03,windows
system04,windows

Example authorize.conf

[role_linux]
srchFilter = role=linux

Example search

 | inputlookup role-lookup.csv

This returns all the lines in the lookup-file, I only want the first two with the role defined in my srchFilter.

Is this possible to achieve somehow? I would like to populate a dashboard dropdown with only the choices the user actually has access to.

I tried some silly workarounds like makeresults and appending the CSV data to trick Splunk into applying the srchFilter rule, but I can't find a way to make this work.

[somesoni2]

A crude workaround will be to query the current user's search filter using REST endpoints and then filter your lookup manually using the results. Please note the this query will be run with current user's account so that they should have proper capabilities to run those

 | inputlookup role-lookup.csv | search | rest /services/authentication/current-context splunk_server=local | table title roles | mvexpand roles | append[| rest /services/authorization/roles splunk_server=local | table title srchFilter | rename title as roles ] | stats values(title) as user values(srchFilter) as search by roles | where isnotnull(user) | table search]

Other option would be to use this search and create scheduled saved search to populate another lookup and use that instead to filter records. Again, it will not filter automatically, you need to include it in your search.

[reubentrapdoor]

Thanks, I was afraid I would have to do something like this. Its a bit too complex and has a too many dependencies to be worth using in a simple dashboard dropdown for my use case, but it might solve someone elses problem.