Getting Data In

Debugging filter strings used with role-based access

sowings
Splunk Employee
Splunk Employee

I'd like to restrict a certain group of users to only see a specific set of hosts within
an index. I can set up the filtering strings using the Roles page of the Splunk Manager.
Now I need to change that filter string, or perhaps my user has said that they can't
see the results they expect.

How can I triage the filter string tied to a role? Is there some log file somewhere that
logs the string that was applied (i.e., that logs the whole search string)? The user's
search history doesn't seem to contain the filter strings. Furthermore, if I'm using
ActiveDirectory for the user authentication, is there any caching of the role data,
specifically the filter strings themselves?

somesoni2
SplunkTrust
SplunkTrust

Another option to see list of search filters associated with users/roles is using REST APIs. This could be a starting point. List all the users, their corresponding roles and search filters.

| rest /services/authentication/users | table title, roles | mvexpand roles | join roles [| rest /services/authorization/roles | table title, srchFilter | rename title as roles] | stats values(roles) as roles, values(srchFilter) as SearchFilters by title

alacercogitatus
SplunkTrust
SplunkTrust

You can try the steps here: http://docs.splunk.com/Documentation/Splunk/6.0.1/Troubleshooting/Enabledebuglogging to enable DEBUG logging. I think you might find it there. You can set "category.QueryLanguageParser=DEBUG" in $SPLUNK_HOME/etc/log.cfg and then check the Job Inspector. It will state which filter string was used. Should narrow down your search a bit.

alacercogitatus
SplunkTrust
SplunkTrust

How'd it work out?

0 Karma

sowings
Splunk Employee
Splunk Employee

Thanks. I'll give this a try and get back to you with the extra karma.

0 Karma

sowings
Splunk Employee
Splunk Employee

I'll give an extra 20 karma to a working answer to this. Double score!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...