topic Re: delete events from _internal index in Getting Data In

delete events from _internal index

gcusello — Tue, 29 Sep 2020 13:39:12 GMT

Hi at all,
I'd like to delete some events indexed with a wrong date (2030-04-03).
I enabled admin to can_delete role and I tried to do this but Splunk answers "You do not have the capability to delete from index=_internal".
Does anyone know if it's possible to do this?
Bye.
giuseppe

Re: delete events from _internal index

lycollicott — Thu, 13 Apr 2017 13:33:24 GMT

I don't believe deleting from _internal is allowed for security, audit, compliance and other assorted butt-covering reasons.

Re: delete events from _internal index

cpetterborg — Thu, 13 Apr 2017 20:38:34 GMT

I've tried deleting from a summary table and been denied as well.

Re: delete events from _internal index

somesoni2 — Thu, 13 Apr 2017 21:19:08 GMT

It seems this is the undocument restriction of the delete command. Howevers, starting 6.5.x, there is a new attribute in town for roles called 'deleteIndexesAllowed'. The semantics of the values is same as 'srchIndexesDefault' so it may allow deleting from _internal index but haven't tested.

deleteIndexesAllowed = <string>
* Semicolon delimited list of indexes this role is allowed to delete
* This setting must be used in conjunction with the delete_by_keyword
  capability
* Follows the same wildcarding semantics as srchIndexesDefault
* Defaults to none

Re: delete events from _internal index

gcusello — Tue, 25 Apr 2017 08:42:39 GMT

Hi somesoni2,
putting in $SPLUNK_HOME/system/local/authorize.conf

[role_can_delete]
deleteIndexesAllowed = *;_internal

I can delete events from _internal index.

Thank you.
Bye.
Giuseppe

Re: delete events from _internal index

deepak_acalvio — Thu, 03 May 2018 13:54:14 GMT

You can use clean eventdata to clean the index completely if needed.