SPL
Every index explicitly granted to a role
Description
Self explanatory, maps roles to indexes. Useful if you have a lot of indexes!
2 0
| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local | fields title,srchIndexesAllowed | rename srchIndexesAllowed as index title as role | mvexpand index | where NOT match(index,".*\*.*")I found this at: https://gist.github.com/acharlieh/3254a7ab13297c760376 Credit goes to acharlieh!
Comments
1 total
Add\r\n\r\n | stats values(role) by index\r\n\r\nat the end to get a by-index summery of roles.
Leave a comment
You must log in to post a comment.