delete events from _internal index

[gcusello]

Hi at all,
I'd like to delete some events indexed with a wrong date (2030-04-03).
I enabled admin to can_delete role and I tried to do this but Splunk answers "You do not have the capability to delete from index=_internal".
Does anyone know if it's possible to do this?
Bye.
giuseppe

[somesoni2 · Accepted solution]

It seems this is the undocument restriction of the delete command. Howevers, starting 6.5.x, there is a new attribute in town for roles called 'deleteIndexesAllowed'. The semantics of the values is same as 'srchIndexesDefault' so it may allow deleting from _internal index but haven't tested.

deleteIndexesAllowed = <string>
* Semicolon delimited list of indexes this role is allowed to delete
* This setting must be used in conjunction with the delete_by_keyword
  capability
* Follows the same wildcarding semantics as srchIndexesDefault
* Defaults to none

[gcusello]

Hi somesoni2,
putting in $SPLUNK_HOME/system/local/authorize.conf

[role_can_delete]
deleteIndexesAllowed = *;_internal

I can delete events from _internal index.

Thank you.
Bye.
Giuseppe

[lycollicott]

I don't believe deleting from _internal is allowed for security, audit, compliance and other assorted butt-covering reasons.

[cpetterborg]

I've tried deleting from a summary table and been denied as well.

[deepak_acalvio]

You can use clean eventdata to clean the index completely if needed.