user is not able to delete alert - Splunk Community

Alerting

What capabilities are needed for a user to delete alerts created by himself?

At the moment it is not possible on our system, no error is given to the user when he selects delete but nothing happens.

Hello @HansK

Did you find a solution for Deleting the Alert?

I have the same issue, yet not resolved.

best regards
Altin

Does the user have the "power" role?

The user does not have the power role, he does have the schedule_search capability though.

as a follow-on, it looks as though the "schedule_search" capability is what allows users to work with alerts, but i'm not 100% sure it allows deletion. here's the info about roles and capabilities in Splunk: http://docs.splunk.com/Documentation/Splunk/6.0/Security/Rolesandcapabilities

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...