Security

Permissions to delete searches in Splunk 6.1.1

adylent
Path Finder

Recently we upgraded to 6.1.1 and I've noticed that users with admin access no longer can delete searches. What permission is needed for this?

It shouldn't be relevant, but we are using search head pooling over NFS.

Thanks

Tags (2)

erritesh17
Path Finder

In Splunk  go to Settings -> Users 

Under actions TAB click on edit and assign a role : can_delete

please check below SS. 

Screenshot 2021-11-12 at 10.32.08 AM.png

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi adylent,

Just had this problem last week, add the can delete capability to the admin and you're done.

Cheers, MuS

bhawkins1
Communicator

To anyone trying to add permissions to a user, you'll have to go to Settings -> Access Controls and select a user. can_delete is here.

0 Karma

MuS
SplunkTrust
SplunkTrust

okay, this question can be read both ways. The search command delete is no longer granted by default (this is the delete_by_keyword capability btw) and must be assigned, also delete does not actually delete raw data; it masks the data from showing up in search results.

To delete searches as local admin, using the Job monitor for example, one does not need any special capability.

Maybe the problem it the search head pooling over NFS, try the OS way from the docs to delete those searches http://docs.splunk.com/Documentation/Splunk/6.1.1/Knowledge/ManagejobsfromtheOS

0 Karma

rtadams89
Contributor

Isn't that capability designed to give the ability to delete data from Splunk using the "delete" command? Per Splunk best practices, this capability should not normally be granted to any users, but instead should only temporarily be granted when specific data needs to be deleted.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...