access problem for delte command ??

[rakesh_498115]

Hi ..

For the Splunk default admin login also , i am getting this error
"#Error in 'delete' command: You have insufficient privileges to delete events" ,
when i use the delete command .. What settings i have to change to get rid of this error ??.

please help thanx.

[echalex · Accepted solution]

Hi,

The delete command requires special privileges, which aren't granted to anyone by default, not even admin. Check the documentation for the delete command. The reason is that the delete command is destructive and irrevokable.

You can grant a user the can_delete role to enable deleting. It is highly recommended that you do this only temporarily for a specific user and remove the role immediately when you're finished deleting.