I'm trying to create a table that displays the following result Appname Amount of users with read access amount of users that have accessed in the last 2 months Open Access Protected Access AppX <number> <number> O P   I know that I can use the rest api for most (maybe all) of this. The following tells me which apps there are and with what roles a user has read access.     | rest /servicesNS/-/-/apps/local splunk_server="local" | fields label, eai:acl.perms.read | rename eai:acl.perms.read as roles | sort by label | search label!=_searchhead_config     The following tells me what users there are and what roles they have.     | rest /services/authentication/users splunk_server=local | fields title roles | mvexpand roles | rename title as userName     What I want to do now is to combine those and by the roles, match which users have access to a certain app, and than count how many there are. I'm a newbie and I've tried all kinds of things with join, append, appendcols but it never gives me the results I need. Can someone point me in the right direction?     ... View more

Hi! We are using a dashboard that displays all the indexes and information about those indexes. I would like to have an additional column. The current search uses this:     | inputlookup name_of_the_lookup | search index=* (index=***) | sort by index | table index, field_A, field_B, field_C, field_D, field_E, field_F, field_G, field_H, field_I, field_J, field_K     What I want to have is an additional column named 'Access',  that says whether it's true or false if the user currently watching that Dashboard has access to that Index. Is there a search that would do this? ... View more