| rest /services/authentication/current-context splunk_server=local
| rename username AS username roles AS role
| mvexpand role
| fields realname username role email
| join type=outer role
[ rest /services/authorization/roles splunk_server=local
| rename title AS role
| eval role_indexes=mvjoin(srchIndexesAllowed,";")
| eval imported_indexes=mvjoin(imported_srchIndexesAllowed,";")
| eval allowed_indexes=mvappend(imported_indexes, role_indexes)
| fields role allowed_indexes role_indexes imported_indexes
| rex mode=sed field=allowed_indexes "s/;/\n/g"
]
| join type=outer role
[ rest /services/admin/LDAP-groups splunk_server=local
| mvexpand roles
| fields roles, strategy,title
| rename roles as role
| rename title as ADGroup]
| table realname username email role allowed_indexes,ADGroup,strategy
... View more