Is there a way to disable the use of the splunk clean command?

[ctwbear]

We would like to have the splunk clean command unavailable to our Splunk administrators. The other idea would be to tie it to a specific role like the "delete" search command and the "can_delete" role.

[changux]

Hi.
What OS do you have? Under linux, you need to use sudo in sudoers file.

Cmnd_Alias SPLUNK = /srv/splunk/bin/splunk restart ! /srv/splunk/bin/splunk clean !
user ALL=(root) NOPASSWD: SPLUNK

You can specify other arguments that are valid in the same Cmnd_Alias line.

Try and tell us about it.

[changux]

Check out the sudoers man page:

http://www.sudo.ws/man/1.8.14/sudoers.man.html