Getting Data In

How to delete events from an indexer?

New Member

Hi
I wanna delete Events from an indexer (x).
First of all, I added "deletebykeyword" capability for admin then I wrote :

index=x suid=th:0 |eval index="x" |delete   

in the search& report app
I saw " error: you don't have capability to delete from index x"
How can I solve it?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

You need to grant admin the 'can_delete' role.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

You need to grant admin the 'can_delete' role.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

With great power, comes great responsibility!

0 Karma