Splunk Search

Query for Users, Roles, AD Groups and Indexes.

aknsun
Path Finder

Hi,

I'm trying to get the query to pull out the following, but struggling a bit with all the joins. I need to get a list of the following in a report.

  1. List of users
  2. The Roles each user is part of.
  3. The AD Group that each user is part of.
  4. The Indexes that each user has access to.

Looks like I will need to be using the below 4 endpoints.

/services/authentication/users
/services/authorization/roles
/services/admin/LDAP-groups
/services/data/indexes

Tags (1)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query on Search Head, not sure whether it will give you all information which you require. It is working fine in my lab environment (Which has very few users)

| rest splunk_server=local /services/authentication/users
| fields title, roles
| mvexpand roles
| append [ | rest splunk_server=local /services/authorization/roles
           | fields imported_roles,imported_srchIndexesAllowed,imported_srchIndexesDefault,srchIndexesAllowed,srchIndexesDefault,title
           | rename title as roles]
| append [ | rest splunk_server=local /services/admin/LDAP-groups
           | fields roles,title
           | rename title as ADGroup]
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(title) as userid, values(ADGroup) as ADGroup by roles
| mvexpand userid
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(roles) as roles, values(ADGroup) as ADGroup by userid

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

Try below query on Search Head, not sure whether it will give you all information which you require. It is working fine in my lab environment (Which has very few users)

| rest splunk_server=local /services/authentication/users
| fields title, roles
| mvexpand roles
| append [ | rest splunk_server=local /services/authorization/roles
           | fields imported_roles,imported_srchIndexesAllowed,imported_srchIndexesDefault,srchIndexesAllowed,srchIndexesDefault,title
           | rename title as roles]
| append [ | rest splunk_server=local /services/admin/LDAP-groups
           | fields roles,title
           | rename title as ADGroup]
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(title) as userid, values(ADGroup) as ADGroup by roles
| mvexpand userid
| stats values(imported_roles) as imported_roles, values(imported_srchIndexesAllowed) as imported_srchIndexesAllowed, values(imported_srchIndexesDefault) as imported_srchIndexesDefault, values(srchIndexesAllowed) as srchIndexesAllowed, values(srchIndexesDefault) as srchIndexesDefault, values(roles) as roles, values(ADGroup) as ADGroup by userid

sriniwf
Loves-to-Learn

It's not working for our environment. Do we have any alternative query for this.

 

Actually in LDAP rest api query , we are only getting admin, user,power , splunk-system-user roles i'm getting.. Due to that, i'm not getting proper results.

 

can you please help me.

0 Karma

aknsun
Path Finder

HI @harsmarvania57. Thanks for the query. I had to make a small change to get it working by adding the following in the 3rd line

| rename title as userid

and including it in the stats

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...