Getting Data In

Delete Command Permissions - Specific Index

snoobzilla
Builder

We are working on a utility to selectively push data into a summary index. Of CRUD operations we do not have Delete.

I would like to have users be able to use delete command against a that summary index, but not others. Is this possible?

Docs indicate the can_delete role is command specific. Is it possible to allow delete only for a specific index? Maybe clone the can_delete role and give it rights to only to a specific index?

0 Karma
1 Solution

dturnbull_splun
Splunk Employee
Splunk Employee

Using |delete depends on ability to search, so you could create a seperate user & role that has only permissions to a single index and includes the can_delete role.

It's not possible to selectively limit | delete

If your data is changing, it's possibly better suited to the KV Store.

View solution in original post

dturnbull_splun
Splunk Employee
Splunk Employee

Using |delete depends on ability to search, so you could create a seperate user & role that has only permissions to a single index and includes the can_delete role.

It's not possible to selectively limit | delete

If your data is changing, it's possibly better suited to the KV Store.

snoobzilla
Builder

Thanks for the info, will forward to my admin.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...