Splunk search for Roles with access to indexes
Copy
| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
| fields title,srchIndexesAllowed
| rename srchIndexesAllowed as Indexes, title as Role | search Indexes=*
This search will show all Splunk roles as well as well as the indexes that they have access to. In order to run this search you must have the rest_properties_get capability.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment