Why can't I delete knowledge objects as admin?

[jonathan_cooper]

Looking at my saved searches, about 99% of them do not have the "delete" action listed. There are one or two that do have it, but the majority do not. I am logged in as an administrator, this is for the search app and I have tested this by creating a private saved search without sharing it with anyone, and I cannot delete even my own saved search.

I've searched around extensively thinking it must have been answered before, but could only find things where app permissions and/or role permissions were the issue. I've checked those things multiple times, and I have every write permission required.

Any ideas? Thanks

[KomalSharma]

Is this problem still there in version 6.2.3? I don't have the delete option for a lot of my reports and searches.

[ben_leung]

This is a reoccurring issue. Are there any known issues with objects not having the Move/Delete action?

Is it some kind of permissions with the objects? For my scenario, the lookup tables have missing actions. What I did was set the [lookups] 's export value to system on all the apps to allow global access. Still facing the issue.

Version 6.3.3

[jonathan_cooper · Accepted solution]

Heh.... answered my own question:
From "Known Issues":
Unable to delete/clone saved searches from Manager -> Searches and Reports. (SPL-52179, SPL-47878)
I'm assuming the only fix is to upgrade...

[ChrisG]

Yes, this was fixed in Splunk 4.3.4, see http://docs.splunk.com/Documentation/Splunk/4.3.4/ReleaseNotes/4.3.4.

[jonathan_cooper]

Heh.... answered my own question:

From "Known Issues":

Unable to delete/clone saved searches from Manager -> Searches and Reports. (SPL-52179, SPL-47878)

I'm assuming the only fix is to upgrade...

[jonathan_cooper]

Replicated this issue in a fresh 4.3.3 environment.

• Created new role named "se", inherits admin role
• Created new user, assigned to "se"
• Created saved search as "admin" user first
• Created saved search as "se" user next
• From both roles, I can delete the "admin" created saved search, but not the "se" role search. Both searches the same, with private permissions.

Could this possibly be a bug??

[jonathan_cooper]

No ideas?? I'm really at a loss and it really inhibits us from managing saved searches properly. The only options I have are to "Run" or "Clone" the saved searches, no delete option, even for my own private saved searches. 😞

[jonathan_cooper]

I performed another test, logged in as another normal user (user role), created a saved search and made no further changes. Logged back in as admin, I cannot delete that saved search. I then logged back in as the user who created the saved search, and the delete option is present.

This seems to be isolated to just the admin role, I just can't for the life of me understand what the problem could be.