topic How do I delete from the 'main' index in Getting Data In

How do I delete from the 'main' index

lstewart_splunk — Wed, 16 Aug 2017 17:56:54 GMT

I have a standalone instance of Splunk Enterprise.
I uploaded a few XML files to perform some testing and now I want to delete the files from the index.
Logged in as admin, I created a user with the role of "can_delete"
I logged in as that user and ran the search to locate the events. My search is "index=main source=*xml". The events appear in the output on the events tab.
I then append " | delete" to the search and I get an error message saying that the events could not be deleted and
"You do not have the capability to delete from index=main"

I have performed this operation successfully before. Not sure why it isn't working now.
I've gone back and tried adding roles to the user, deleting and recreating the user. Nothing works.
Any suggestions?

Re: How do I delete from the 'main' index

masonmorales — Wed, 16 Aug 2017 23:59:09 GMT

Is the new user inheriting both the admin role as well as the can_delete role? Try restarting Splunk after updating the user's roles. You shouldn't have to restart, but maybe you've encountered a bug that is preventing the role's permissions from updating...

Re: How do I delete from the 'main' index

gcusello — Thu, 17 Aug 2017 07:35:45 GMT

Hi lstewart [Splunk],
I had the same problem last year with _internal index, there is a restriction of the delete command.
Howevers, starting 6.5.x, there is a new attribute in town for roles called 'deleteIndexesAllowed' (see http://docs.splunk.com/Documentation/Splunk/latest/admin/authorizeconf ).

deleteIndexesAllowed = <string>
* Semicolon delimited list of indexes this role is allowed to delete
* This setting must be used in conjunction with the delete_by_keyword
  capability
* Follows the same wildcarding semantics as srchIndexesDefault
* Defaults to none

The semantics of the values is same as 'srchIndexesDefault'

Try this

put in $SPLUNK_HOME/system/local/authorize.conf (if it doesn't exist, create it) and restart Splunk

 [role_can_delete]
 deleteIndexesAllowed = *;main

Bye.
Giuseppe

Re: How do I delete from the 'main' index

rgreer — Fri, 06 Apr 2018 18:04:44 GMT

This worked for me. Once I added deleteIndexesAllowed to my authorize.conf and restarted Splunk, I was able to remove the data I wanted.

Re: How do I delete from the 'main' index

gcusello — Wed, 10 Jul 2019 11:44:14 GMT

Hi lstewart [Splunk],
If you're satisfied by this answer, please accept and/or upvote it.
Bye.
Giuseppe

Re: How do I delete from the 'main' index

sonny_monti — Wed, 10 Jul 2019 12:14:29 GMT

You did the correct think to inherit role can_delete and admin capabilities.
Maybe the changes did not go in memory so try this:

Go in $SPLUNK_HOME/bin
From the terminal/console on the SH: ./splunk reload auth (for windows .\splunk reload auth)
pipe the delete command on your search

This command reloads the authorizations of splunk.
Let me know if that worked, and give me a upvote if you find this

Re: How do I delete from the 'main' index

sam_indeed — Wed, 08 Dec 2021 18:01:14 GMT

Just replying here in case anyone else stumbles upon this and can't find the same folder, click on the documentation link!

The updated path is

$SPLUNK_HOME/etc/system/local/