Splunk Search

srchFilter and inputlookup

reubentrapdoor
Engager

Is it possible to filter results in a lookup-file with filters defined in "srchFilter" in authorize.conf?

Example lookup:

[role-lookup.csv]
system,role
system01,linux
system02,linux
system03,windows
system04,windows

Example authorize.conf

[role_linux]
srchFilter = role=linux

Example search

 | inputlookup role-lookup.csv

This returns all the lines in the lookup-file, I only want the first two with the role defined in my srchFilter.

Is this possible to achieve somehow? I would like to populate a dashboard dropdown with only the choices the user actually has access to.

I tried some silly workarounds like makeresults and appending the CSV data to trick Splunk into applying the srchFilter rule, but I can't find a way to make this work.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

A crude workaround will be to query the current user's search filter using REST endpoints and then filter your lookup manually using the results. Please note the this query will be run with current user's account so that they should have proper capabilities to run those

 | inputlookup role-lookup.csv | search | rest /services/authentication/current-context splunk_server=local | table title roles | mvexpand roles | append[| rest /services/authorization/roles splunk_server=local | table title srchFilter | rename title as roles ] | stats values(title) as user values(srchFilter) as search by roles | where isnotnull(user) | table search]

Other option would be to use this search and create scheduled saved search to populate another lookup and use that instead to filter records. Again, it will not filter automatically, you need to include it in your search.

reubentrapdoor
Engager

Thanks, I was afraid I would have to do something like this. Its a bit too complex and has a too many dependencies to be worth using in a simple dashboard dropdown for my use case, but it might solve someone elses problem.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...