Getting Data In

No "delete" available for some searches in Manager, so how do I delete them?

SplunkTrust
SplunkTrust

I have some searches that, when I list them in Manager, don't have anything but Run and Clone under Actions. There is no Delete (or Move or Clone either). I am the owner, and I have also gone in as admin and it is the same - the actions are not there for some of the searches. So how can I delete these?

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

What version of Splunk are you using? There was a bug in 4.3.3, fixed in 4.3.4 (listed in the known issues): Unable to delete/clone saved searches from Manager -> Searches and Reports. (SPL-52179, SPL-47878).

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

What version of Splunk are you using? There was a bug in 4.3.3, fixed in 4.3.4 (listed in the known issues): Unable to delete/clone saved searches from Manager -> Searches and Reports. (SPL-52179, SPL-47878).

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

So, yes, that's a known issue for at least 4.3.2 and 4.3.3...it's possible it exists in your version as well. It is marked as fixed in the 4.3.4 change log, so the problem should go away when you move to 4.3.5.

0 Karma

SplunkTrust
SplunkTrust

We are on 4.3, not 4.3.x. We are supposed to upgrade our current to 4.3.5, in preparation to do a complete replacement upgrade with 5.0, but we are not there yet. Sorry I didn't put this in my original question.

0 Karma