Getting Data In

Why can't I delete knowledge objects as admin?

jonathan_cooper
Communicator

Looking at my saved searches, about 99% of them do not have the "delete" action listed. There are one or two that do have it, but the majority do not. I am logged in as an administrator, this is for the search app and I have tested this by creating a private saved search without sharing it with anyone, and I cannot delete even my own saved search.

I've searched around extensively thinking it must have been answered before, but could only find things where app permissions and/or role permissions were the issue. I've checked those things multiple times, and I have every write permission required.

Any ideas? Thanks

Tags (2)
0 Karma
1 Solution

jonathan_cooper
Communicator

Heh.... answered my own question:
From "Known Issues":
Unable to delete/clone saved searches from Manager -> Searches and Reports. (SPL-52179, SPL-47878)
I'm assuming the only fix is to upgrade...

View solution in original post

KomalSharma
Explorer

Is this problem still there in version 6.2.3? I don't have the delete option for a lot of my reports and searches.

ben_leung
Builder

This is a reoccurring issue. Are there any known issues with objects not having the Move/Delete action?

Is it some kind of permissions with the objects? For my scenario, the lookup tables have missing actions. What I did was set the [lookups] 's export value to system on all the apps to allow global access. Still facing the issue.

Version 6.3.3

0 Karma

jonathan_cooper
Communicator

Heh.... answered my own question:
From "Known Issues":
Unable to delete/clone saved searches from Manager -> Searches and Reports. (SPL-52179, SPL-47878)
I'm assuming the only fix is to upgrade...

ChrisG
Splunk Employee
Splunk Employee
0 Karma

jonathan_cooper
Communicator

Heh.... answered my own question:

From "Known Issues":

Unable to delete/clone saved searches from Manager -> Searches and Reports. (SPL-52179, SPL-47878)

I'm assuming the only fix is to upgrade...

0 Karma

jonathan_cooper
Communicator

Replicated this issue in a fresh 4.3.3 environment.

  • Created new role named "se", inherits admin role
  • Created new user, assigned to "se"
  • Created saved search as "admin" user first
  • Created saved search as "se" user next
  • From both roles, I can delete the "admin" created saved search, but not the "se" role search. Both searches the same, with private permissions.

Could this possibly be a bug??

0 Karma

jonathan_cooper
Communicator

No ideas?? I'm really at a loss and it really inhibits us from managing saved searches properly. The only options I have are to "Run" or "Clone" the saved searches, no delete option, even for my own private saved searches. 😞

0 Karma

jonathan_cooper
Communicator

I performed another test, logged in as another normal user (user role), created a saved search and made no further changes. Logged back in as admin, I cannot delete that saved search. I then logged back in as the user who created the saved search, and the delete option is present.

This seems to be isolated to just the admin role, I just can't for the life of me understand what the problem could be.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...