Show Splunk User to Role mapping

The following Splunk REST query shows all roles, number of  capabilities, and landing app for each user.

| rest /services/authentication/users 
| eval name=coalesce(realname, title) 
| stats values(roles) as Role first(defaultApp) as "Landing App" count(capabilities) as "Number of Capabilities" by name
Share This:

Leave A Comment?