https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377095#M9303 <P>@athorat,<BR /> Have you posted your entire role definition above or is it only some part of it?<BR /> Because, search capability is missing in the above role definition which is required and also the <CODE>srchIndexesAllowed</CODE> has only _audit. Probably you need to add prod-test* as well so that the users can search on those indexes as well.</P> Wed, 03 Apr 2019 13:52:21 GMT renjith_nair 2019-04-03T13:52:21Z https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377092#M9300 <P>Want to grant delete permissions for a non admin account for specific prod-test-* indexes<BR /> Created a new role and mapped it to an AD group but does not seem to like it. Users still get , Error in 'delete' command: You have insufficient privileges to delete events. </P> <PRE><CODE>[role_test_access] srchIndexesAllowed = _audit deleteIndexesAllowed = prod-test* delete_by_keyword= enabled </CODE></PRE> <P>Any suggestions highly appreciated.</P> Sat, 30 Mar 2019 19:15:19 GMT https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377092#M9300 athorat 2019-03-30T19:15:19Z https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377093#M9301 <P>@athorat,</P> <P>Add the below also to your authorize.conf </P> <PRE><CODE>importRoles = can_delete </CODE></PRE> Sun, 31 Mar 2019 03:10:49 GMT https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377093#M9301 renjith_nair 2019-03-31T03:10:49Z https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377094#M9302 <P>Thanks @renjith.nair , Doesnt seem to work. </P> Mon, 01 Apr 2019 17:54:31 GMT https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377094#M9302 athorat 2019-04-01T17:54:31Z https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377095#M9303 <P>@athorat,<BR /> Have you posted your entire role definition above or is it only some part of it?<BR /> Because, search capability is missing in the above role definition which is required and also the <CODE>srchIndexesAllowed</CODE> has only _audit. Probably you need to add prod-test* as well so that the users can search on those indexes as well.</P> Wed, 03 Apr 2019 13:52:21 GMT https://community.splunk.com/t5/Security/delete-by-keyword-not-working/m-p/377095#M9303 renjith_nair 2019-04-03T13:52:21Z