Is there a way to see the properties of a Role from the internal logs?

[john_glasscock]

I want to create a report or a dashboard to show roles and what indexes they have access to. Is there a way to do so from the internal logs?

[MuS · Accepted solution]

Hi john.glasscock,

you can use a REST call (if you have permission to do so) to get the information you are after, try this :

 | rest /services/authorization/roles splunk_server=local 
 | table title imported_roles srchIndexesDefault imported_srchIndexesDefault

You can find more information about the REST API in Splunk here http://docs.splunk.com/Documentation/Splunk/latest/RESTUM/RESTusing

Hope this helps ...

cheers, MuS