https://community.splunk.com/t5/Deployment-Architecture/clean-event-data/m-p/25253#M22022 <P>Is there a way to disable this? We would like to ensure data integrity since other admins have root access on our splunk servers.</P> Tue, 06 Nov 2012 16:09:57 GMT diegosainz 2012-11-06T16:09:57Z https://community.splunk.com/t5/Deployment-Architecture/clean-event-data/m-p/25253#M22022 <P>Is there a way to disable this? We would like to ensure data integrity since other admins have root access on our splunk servers.</P> Tue, 06 Nov 2012 16:09:57 GMT https://community.splunk.com/t5/Deployment-Architecture/clean-event-data/m-p/25253#M22022 diegosainz 2012-11-06T16:09:57Z https://community.splunk.com/t5/Deployment-Architecture/clean-event-data/m-p/25254#M22023 <P>I am not aware of a method by which you can limit a subcommand of the $SPLUNK_HOME/bin/splunk command from the root user, but keep in mind beyond that, that ever index is essentially written to database files in the $SPLUNK_HOME filesystem. Because of that the root user will always be able to delete those files. Such is the price of providing root access to users in a Unix/Linux environment.</P> Mon, 28 Sep 2020 12:45:02 GMT https://community.splunk.com/t5/Deployment-Architecture/clean-event-data/m-p/25254#M22023 pwattssplunk 2020-09-28T12:45:02Z