Hi,
I would like to create a list of users belonging to a certain role using a saved search. Is this information available from one of the internal indexes?
Thanks in advance.
You can get this information from the rest endpoint on a per user basis, but I don't know of any way to query a role for its users. Take a look at:
https://splunkserver:8089/services/authentication/users
You should be able to get what you need from here.
You can get this information from the rest endpoint on a per user basis, but I don't know of any way to query a role for its users. Take a look at:
https://splunkserver:8089/services/authentication/users
You should be able to get what you need from here.