https://community.splunk.com/t5/Getting-Data-In/How-to-delete-events-from-an-indexer/m-p/436255#M76124 <P>With great power, comes great responsibility! </P> Sun, 10 Mar 2019 13:15:03 GMT skoelpin 2019-03-10T13:15:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-events-from-an-indexer/m-p/436253#M76122 <P>Hi <BR /> I wanna delete Events from an indexer (x).<BR /> First of all, I added "delete_by_keyword" capability for admin then I wrote :</P> <PRE><CODE>index=x suid=th:0 |eval index="x" |delete </CODE></PRE> <P>in the search&amp; report app<BR /> I saw <CODE>" error: you don't have capability to delete from index x"</CODE><BR /> How can I solve it?</P> Tue, 29 Sep 2020 23:40:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-events-from-an-indexer/m-p/436253#M76122 mojgh94 2020-09-29T23:40:16Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-events-from-an-indexer/m-p/436254#M76123 <P>You need to grant admin the 'can_delete' role.</P> Sun, 10 Mar 2019 13:01:59 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-events-from-an-indexer/m-p/436254#M76123 richgalloway 2019-03-10T13:01:59Z https://community.splunk.com/t5/Getting-Data-In/How-to-delete-events-from-an-indexer/m-p/436255#M76124 <P>With great power, comes great responsibility! </P> Sun, 10 Mar 2019 13:15:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-delete-events-from-an-indexer/m-p/436255#M76124 skoelpin 2019-03-10T13:15:03Z