<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Why are Triggered Alerts not getting deleted by a non-Owner User? in Alerting</title>
    <link>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109327#M1596</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;We have the following scenario:&lt;/P&gt;

&lt;P&gt;A User &lt;STRONG&gt;X&lt;/STRONG&gt; mapped to Role &lt;STRONG&gt;A&lt;/STRONG&gt;, creates a Scheduled Search that triggers an Alert 5 times in a Day. These are listed in the Triggered Alerts section, with &lt;STRONG&gt;Owner&lt;/STRONG&gt; as User &lt;STRONG&gt;X&lt;/STRONG&gt;. We have other Users &lt;STRONG&gt;Y&lt;/STRONG&gt; and &lt;STRONG&gt;Z&lt;/STRONG&gt;, also mapped to role &lt;STRONG&gt;A&lt;/STRONG&gt;, who are able to view these Alerts in the Triggered Alerts section. These  Users Y and Z are able to view results for these Alerts, they are able to edit the underlying scheduled search as well. But they are not able to &lt;STRONG&gt;Delete&lt;/STRONG&gt; those Alerts. The Alerts can &lt;STRONG&gt;only&lt;/STRONG&gt; be deleted by either the &lt;STRONG&gt;Owner&lt;/STRONG&gt; &lt;STRONG&gt;X&lt;/STRONG&gt;, or by a User mapped to &lt;STRONG&gt;admin&lt;/STRONG&gt; Role. &lt;/P&gt;

&lt;P&gt;We do not wish to give Users &lt;STRONG&gt;Y&lt;/STRONG&gt; and &lt;STRONG&gt;Z&lt;/STRONG&gt; an admin access, but we want them to be able to deleted these Alerts, as they are also mapped to the same Role &lt;STRONG&gt;A&lt;/STRONG&gt;, as the User &lt;STRONG&gt;X&lt;/STRONG&gt;.&lt;/P&gt;

&lt;P&gt;Could someone please suggest what could be done in this scenario? We have tried assigning &lt;STRONG&gt;power&lt;/STRONG&gt; role to Users &lt;STRONG&gt;Y&lt;/STRONG&gt; and &lt;STRONG&gt;Z&lt;/STRONG&gt;, but even that did not work.&lt;/P&gt;</description>
    <pubDate>Wed, 13 May 2015 13:42:54 GMT</pubDate>
    <dc:creator>SwatiApte</dc:creator>
    <dc:date>2015-05-13T13:42:54Z</dc:date>
    <item>
      <title>Why are Triggered Alerts not getting deleted by a non-Owner User?</title>
      <link>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109327#M1596</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;We have the following scenario:&lt;/P&gt;

&lt;P&gt;A User &lt;STRONG&gt;X&lt;/STRONG&gt; mapped to Role &lt;STRONG&gt;A&lt;/STRONG&gt;, creates a Scheduled Search that triggers an Alert 5 times in a Day. These are listed in the Triggered Alerts section, with &lt;STRONG&gt;Owner&lt;/STRONG&gt; as User &lt;STRONG&gt;X&lt;/STRONG&gt;. We have other Users &lt;STRONG&gt;Y&lt;/STRONG&gt; and &lt;STRONG&gt;Z&lt;/STRONG&gt;, also mapped to role &lt;STRONG&gt;A&lt;/STRONG&gt;, who are able to view these Alerts in the Triggered Alerts section. These  Users Y and Z are able to view results for these Alerts, they are able to edit the underlying scheduled search as well. But they are not able to &lt;STRONG&gt;Delete&lt;/STRONG&gt; those Alerts. The Alerts can &lt;STRONG&gt;only&lt;/STRONG&gt; be deleted by either the &lt;STRONG&gt;Owner&lt;/STRONG&gt; &lt;STRONG&gt;X&lt;/STRONG&gt;, or by a User mapped to &lt;STRONG&gt;admin&lt;/STRONG&gt; Role. &lt;/P&gt;

&lt;P&gt;We do not wish to give Users &lt;STRONG&gt;Y&lt;/STRONG&gt; and &lt;STRONG&gt;Z&lt;/STRONG&gt; an admin access, but we want them to be able to deleted these Alerts, as they are also mapped to the same Role &lt;STRONG&gt;A&lt;/STRONG&gt;, as the User &lt;STRONG&gt;X&lt;/STRONG&gt;.&lt;/P&gt;

&lt;P&gt;Could someone please suggest what could be done in this scenario? We have tried assigning &lt;STRONG&gt;power&lt;/STRONG&gt; role to Users &lt;STRONG&gt;Y&lt;/STRONG&gt; and &lt;STRONG&gt;Z&lt;/STRONG&gt;, but even that did not work.&lt;/P&gt;</description>
      <pubDate>Wed, 13 May 2015 13:42:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109327#M1596</guid>
      <dc:creator>SwatiApte</dc:creator>
      <dc:date>2015-05-13T13:42:54Z</dc:date>
    </item>
    <item>
      <title>Re: Why are Triggered Alerts not getting deleted by a non-Owner User?</title>
      <link>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109328#M1597</link>
      <description>&lt;P&gt;When setting &lt;STRONG&gt;permissions&lt;/STRONG&gt; to your alert, make sure that   &lt;STRONG&gt;role A&lt;/STRONG&gt; can  &lt;STRONG&gt;Read&lt;/STRONG&gt; and &lt;STRONG&gt;write&lt;/STRONG&gt; the alert, by simply check the read and the write box in front of Role A.&lt;BR /&gt;
Thanks &lt;/P&gt;</description>
      <pubDate>Wed, 13 May 2015 16:10:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109328#M1597</guid>
      <dc:creator>stephanefotso</dc:creator>
      <dc:date>2015-05-13T16:10:23Z</dc:date>
    </item>
    <item>
      <title>Re: Why are Triggered Alerts not getting deleted by a non-Owner User?</title>
      <link>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109329#M1598</link>
      <description>&lt;P&gt;Read and Write both are checked for Role A. This just enables users Y and Z to be able to modify the underlying search. But not to delete the triggered alert.&lt;/P&gt;</description>
      <pubDate>Wed, 13 May 2015 16:24:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109329#M1598</guid>
      <dc:creator>SwatiApte</dc:creator>
      <dc:date>2015-05-13T16:24:04Z</dc:date>
    </item>
    <item>
      <title>Re: Why are Triggered Alerts not getting deleted by a non-Owner User?</title>
      <link>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109330#M1599</link>
      <description>&lt;P&gt;Add the  &lt;CODE&gt;Admin_all_objects&lt;/CODE&gt;  capability to the &lt;STRONG&gt;Role A&lt;/STRONG&gt;  on  &lt;STRONG&gt;Settings--- Access control---Role ---Role A&lt;/STRONG&gt; and click on &lt;STRONG&gt;admin_all_objects&lt;/STRONG&gt; at the left side of the &lt;STRONG&gt;Capabilities&lt;/STRONG&gt; box, to make it appear at the ritht side, and save.&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 19:53:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109330#M1599</guid>
      <dc:creator>stephanefotso</dc:creator>
      <dc:date>2020-09-28T19:53:52Z</dc:date>
    </item>
    <item>
      <title>Re: Why are Triggered Alerts not getting deleted by a non-Owner User?</title>
      <link>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109331#M1600</link>
      <description>&lt;P&gt;Assigning the admin_all_objects capabilities enables the Users with Role A to be able to view some system settings, distributed settings, etc as well, which we don't want. As of now, assigning the Owner to 'nobody' for the scheduled searches has worked for me. Does having 'nobody' as Owner have any adverse impact?&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 19:57:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109331#M1600</guid>
      <dc:creator>SwatiApte</dc:creator>
      <dc:date>2020-09-28T19:57:45Z</dc:date>
    </item>
    <item>
      <title>Re: Why are Triggered Alerts not getting deleted by a non-Owner User?</title>
      <link>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109332#M1601</link>
      <description>&lt;P&gt;There is no impact. It just Means  that &lt;STRONG&gt;Every one&lt;/STRONG&gt;  and  &lt;STRONG&gt;Admin&lt;/STRONG&gt; can edit your scheduled searche.&lt;/P&gt;</description>
      <pubDate>Fri, 15 May 2015 12:22:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Why-are-Triggered-Alerts-not-getting-deleted-by-a-non-Owner-User/m-p/109332#M1601</guid>
      <dc:creator>stephanefotso</dc:creator>
      <dc:date>2015-05-15T12:22:29Z</dc:date>
    </item>
  </channel>
</rss>

