Splunk Search

search to get an overview of all dashboards and apps with authorizations

rrovers
Communicator

I have a search to get an overview of all users with their authorizations: roles, capabilities, indexes (search found somewhere else on this community).

I wonder if it is also possible to get an overview of the apps and dashboards with the coupled roles.

Does anyone know if this is possible and if so how to do it?

 

 

Labels (1)
0 Karma
1 Solution

rrovers
Communicator

Hi @richgalloway, thanks, if I combine these 2 I get the result I want:

| rest /servicesNS/-/-/data/ui/views
| rename eai:acl.app AS app
| rename eai:acl.perms.write as dashboard-write-permission
| rename eai:acl.perms.read as dashboard-read-permission
| rename eai:appName as appName
| join type=outer appName
[| rest /servicesNS/-/-/apps/local
| rename title AS appName
| rename eai:acl.perms.read AS app-read-permission
| rename eai:acl.perms.write AS app-write-permission]
| table app label title dashboard-read-permission dashboard-read-permission app-write-permission app-read-permission

View solution in original post

0 Karma

rrovers
Communicator

Hi @richgalloway, thanks, if I combine these 2 I get the result I want:

| rest /servicesNS/-/-/data/ui/views
| rename eai:acl.app AS app
| rename eai:acl.perms.write as dashboard-write-permission
| rename eai:acl.perms.read as dashboard-read-permission
| rename eai:appName as appName
| join type=outer appName
[| rest /servicesNS/-/-/apps/local
| rename title AS appName
| rename eai:acl.perms.read AS app-read-permission
| rename eai:acl.perms.write AS app-write-permission]
| table app label title dashboard-read-permission dashboard-read-permission app-write-permission app-read-permission

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can get a list of apps and dashboards using REST commands, but it will come with user names rather than role names.  You'll have to correlate with your user list to get roles.

Try 

| rest /servicesNS/-/-/data/ui/views

| rest /servicesNS/-/-/apps/local
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...