Getting Data In

access problem for delte command ??

rakesh_498115
Motivator

Hi ..

For the Splunk default admin login also , i am getting this error
"#Error in 'delete' command: You have insufficient privileges to delete events" ,
when i use the delete command .. What settings i have to change to get rid of this error ??.

please help thanx.

Tags (2)
1 Solution

echalex
Builder

Hi,

The delete command requires special privileges, which aren't granted to anyone by default, not even admin. Check the documentation for the delete command. The reason is that the delete command is destructive and irrevokable.

You can grant a user the can_delete role to enable deleting. It is highly recommended that you do this only temporarily for a specific user and remove the role immediately when you're finished deleting.

View solution in original post

echalex
Builder

Hi,

The delete command requires special privileges, which aren't granted to anyone by default, not even admin. Check the documentation for the delete command. The reason is that the delete command is destructive and irrevokable.

You can grant a user the can_delete role to enable deleting. It is highly recommended that you do this only temporarily for a specific user and remove the role immediately when you're finished deleting.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...