topic Re: Unable to delete data from Splunk Cloud trial in Getting Data In

Unable to delete data from Splunk Cloud trial

nickblack — Mon, 28 Sep 2020 19:54:25 GMT

Hi,
I managed to import the tutorial data twice into my Splunk Cloud sandbox trial (once into the wrong place).
So consequently wanted to delete the incorrect host.
I tried to run 'host=splunk_cloud_trial | delete' in search but came back with:
'Error in 'delete' command: You have insufficient privileges to delete events.'

I stumbled across adding 'delete_by_keyword' capability to sc_admin role, but it won't let me with the error:
'Encountered the following error while trying to update: Client is not authorized to perform requested action'.

Any ideas?
Cheerss

Re: Unable to delete data from Splunk Cloud trial

satishsdange — Fri, 15 May 2015 05:08:26 GMT

Clearly you don't have sufficient rights to clean eventdata. You should contact support team. I doubt whether you will get any response considering this is sandbox POC setup.
Quick solution is to create another index & ingest that data once again. Or install Splunk on your laptop/desktop & complete your exercise.

Re: Unable to delete data from Splunk Cloud trial

jimmpoul — Fri, 15 May 2015 12:09:08 GMT

We are using Splunk Cloud and had to ask support to be allowed to delete data. Normally you should be able to give the permission to yourself as admin, but there are some limitations to what you can change regarding security in Splunk Cloud.

Re: Unable to delete data from Splunk Cloud trial

yannK — Fri, 11 Sep 2015 15:00:05 GMT

ultimately, cloud trials are automatically delete after 15 days, your data will go away with it.