Alerting

user is not able to delete alert

HansK
Path Finder

What capabilities are needed for a user to delete alerts created by himself?

At the moment it is not possible on our system, no error is given to the user when he selects delete but nothing happens.

Tags (3)
0 Karma

altink
Contributor

Hello @HansK 

Did you find a solution for Deleting the Alert?

I have the same issue, yet not resolved.

best regards
Altin

0 Karma

ChrisG
Splunk Employee
Splunk Employee

Does the user have the "power" role?

HansK
Path Finder

The user does not have the power role, he does have the schedule_search capability though.

0 Karma

piebob
Motivator

as a follow-on, it looks as though the "schedule_search" capability is what allows users to work with alerts, but i'm not 100% sure it allows deletion. here's the info about roles and capabilities in Splunk: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Rolesandcapabilities

Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...