Getting Data In

Unable to delete data from Splunk Cloud trial

nickblack
New Member

Hi,
I managed to import the tutorial data twice into my Splunk Cloud sandbox trial (once into the wrong place).
So consequently wanted to delete the incorrect host.
I tried to run 'host=splunk_cloud_trial | delete' in search but came back with:
'Error in 'delete' command: You have insufficient privileges to delete events.'

I stumbled across adding 'delete_by_keyword' capability to sc_admin role, but it won't let me with the error:
'Encountered the following error while trying to update: Client is not authorized to perform requested action'.

Any ideas?
Cheerss

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

ultimately, cloud trials are automatically delete after 15 days, your data will go away with it.

0 Karma

satishsdange
Builder

Clearly you don't have sufficient rights to clean eventdata. You should contact support team. I doubt whether you will get any response considering this is sandbox POC setup.
Quick solution is to create another index & ingest that data once again. Or install Splunk on your laptop/desktop & complete your exercise.

0 Karma

jimmpoul
Explorer

We are using Splunk Cloud and had to ask support to be allowed to delete data. Normally you should be able to give the permission to yourself as admin, but there are some limitations to what you can change regarding security in Splunk Cloud.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...