Reporting

Splunk Java SDK is not working based on splunk role/index defined for the user

angelinealex
Communicator

I am using Splunk Java SDK to fetch data from Splunk index.

I have the below in my splunk server.
User - Customer_1_User1
Role - customer1_role (which have access to only customer1_index)
Saved Search Name - test_savedsearch

I am connecting to splunk from the java application (using Splunk Java SDK) using below code snippet

    loginArgs.setUsername("Customer_1_User1"));             
    loginArgs.setPassword("xxxx"));                 
    loginArgs.setHost("splunkHostName"));                                   
    loginArgs.setPort(8059);
    Service splunkService = Service.connect(loginArgs)

    //Get the earliest and latest time
SavedSearchDispatchArgs savedSearchDispatchArgs = getEarliestAndLatestTime();

SavedSearchCollection savedSearches = splunkService.getSavedSearches();
SavedSearch savedSearch = splunkService.getSavedSearches().get("test_savedsearch");
Job jobSavedSearch = savedSearch.dispatch(savedSearchDispatchArgs);
Map<String, Object> arguments = new HashMap<String, Object>();
arguments.put("count", 0);
InputStream resultsNormalSearch = jobSavedSearch.getResults(arguments);
ResultsReaderXml resultsReaderNormalSearch = new ResultsReaderXml(resultsNormalSearch);

//fetch data from resultsReaderNormalSearch

When I am trying to fetch data from test_savedsearch through java its returning 500 records.

'customer1_index' has 150 records only. Its fetching 150 records properly when I run the saved search in splunk.

Why its fetching all data through java application irrespective of roles/index defined to the user??

Please help to resolve this issue.

0 Karma

xpac
SplunkTrust
SplunkTrust

Please add the lines of code where you actually start the search, fetch the results etc.

0 Karma

angelinealex
Communicator

updated my code. Please have a look.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...