Splunk Searches | A collection of useful Splunk SPL

Splunk Search for List of Users by Splunk Role Copy


				| rest splunk_server=local /services/authentication/users | table title roles

0 comments

[0]

Splunk Search for Roles and user permissions Copy


				| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local | fields title, capabilities

0 comments

[0]

Splunk Search for Roles with access to indexes Copy


				| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
 | fields title,srchIndexesAllowed
 | rename srchIndexesAllowed as Indexes, title as Role | search Indexes=*

0 comments

[0]