restrict users from deleting other users knowledge objects

Path Finder

Hi Everyone,

I need some help in restrict users from deleting other users knowledge objects.Recently one of the user has deleted the alerts which belongs to  other team.We need to restrict them in deleting other KO's and they have only the capability of deleting their own and share their KO's globally. All this is related to search and reporting app.

Below is the existing config which we are using currently.Kindly advise me on tweaking the setting to achieve the above mentioned restrictions.


accelerate_search = enabled
cumulativeRTSrchJobsQuota = 50
edit_search_schedule_window = enabled
export_results_is_visible = enabled
get_metadata = enabled
get_typeahead = enabled
pattern_detect = enabled
rest_properties_get = enabled
rtSrchJobsQuota = 5
rtsearch = enabled
schedule_search = enabled
search = enabled
srchDiskQuota = 200
srchIndexesAllowed = vpn
srchIndexesDefault = vpn
srchJobsQuota = 20
srchMaxTime = 0

And the permission for search and reporting are as follows.

access = read : [ * ], write : [ * ]
export = none

Thank you.



Labels (4)
0 Karma

Super Champion

user from the above role role_vpn deleted KO's of other user?

If this helps, give a like below.
0 Karma

Path Finder

@thambisetty  yes all have write access to search app , we gave write access to enable sharing option , but some users without knowledge are deleting others KOs(including other KOs created by other roles).

The config which I shared is same for all the roles.Any help is highly appreciated.Thanks

0 Karma

I propose that you will add separate apps for those groups and then create roles per app. Then all write should be done via those. Personally I don’t like the idea that all users can share KOs globally. Usually this generates more issues than solves those especially when you are using those separate apps and sharing KOs only in app level.
r. Ismo
0 Karma

Path Finder

@isoutamo  Thanks for the reply.Can we update the existing roles where users get the capability to share but not delete the objects of others within search app,  rather than creating a lot of new apps for each role



Tags (1)
0 Karma

I don’t think so. If user has the write/modify capability then they can also delete.
0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...