I'm looking for a way to search all indexes available for each role in Splunk (including access inherited from other roles). This search almost does this:
| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local | fields title,srchIndexesAllowed | rename srchIndexesAllowed as Indexes, title as Role | search Indexes=*
However, this does not account for inherited indexes. Listing indexes available for a single role is fairly easy (but time consuming): Under Settings -> Roles -> Select a role (or Edit) Open "Indexes" Tab Filter "Show Selected" from the far right column.
-----------------------
Is there a way to get this list (for all roles) from SQL?
... View more