What capabilities are needed for a user to delete alerts created by himself?
At the moment it is not possible on our system, no error is given to the user when he selects delete but nothing happens.
Hello @HansK Did you find a solution for Deleting the Alert?
I have the same issue, yet not resolved.
best regardsAltin
Does the user have the "power" role?
The user does not have the power role, he does have the schedule_search capability though.
as a follow-on, it looks as though the "schedule_search" capability is what allows users to work with alerts, but i'm not 100% sure it allows deletion. here's the info about roles and capabilities in Splunk: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Rolesandcapabilities
