user is not able to delete alert

Path Finder

What capabilities are needed for a user to delete alerts created by himself?

At the moment it is not possible on our system, no error is given to the user when he selects delete but nothing happens.

Tags (3)
0 Karma


Hello @HansK 

Did you find a solution for Deleting the Alert?

I have the same issue, yet not resolved.

best regards

0 Karma

Splunk Employee
Splunk Employee

Does the user have the "power" role?

Path Finder

The user does not have the power role, he does have the schedule_search capability though.

0 Karma


as a follow-on, it looks as though the "schedule_search" capability is what allows users to work with alerts, but i'm not 100% sure it allows deletion. here's the info about roles and capabilities in Splunk:

Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...