Skip to content

Instantly share code, notes, and snippets.

@androchentw

androchentw/ Fun Splunk Queries

Forked from acharlieh/ Fun Splunk Queries
Created July 5, 2021 15:18
Show Gist options
  • Save androchentw/a5f9c59e7a41725544959f539d3ea8fc to your computer and use it in GitHub Desktop.
Save androchentw/a5f9c59e7a41725544959f539d3ea8fc to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Every index explicitly granted to a role
| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
| fields title,srchIndexesAllowed
| rename srchIndexesAllowed as index title as role
| mvexpand index
| where NOT match(index,".*\*.*")
Raw
Splunk Objects With Perms granted to non-existent roles
| rest /servicesNS/-/-/admin/directory count=0 splunk_server=local
| fields eai:acl.app, eai:acl.owner, eai:acl.perms.*, eai:acl.sharing, eai:location, title
| eval perms=mvappend('eai:acl.perms.read','eai:acl.perms.write')
| fields - eai:acl.perms.*
| mvexpand perms
| where perms!="*" AND NOT
[
| rest /servicesNS/-/-/authorization/roles count=0 splunk_server=local
| fields title
| rename title as perms
]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment