I recently upgraded from 4.2 to 4.3. Since then, I cannot delete from a remote command line.
sourcetype="dontcare" | delete
Returns:
Login failed
Unauthorized
I am using a shell script to remotely connect to a remote windows splunk server.
This worked with 4.2, and I am passing the credentials on the command line.
Since 4.3, it does not work.
If you've verified that the username and password are correct (Login failed?!), that user role may not have the "delete_by_keyword" capability. By default, this is assigned to the "can_delete" role, but not the "admin" role.
Yes, I checked that as well. As stated, this was fine in 4.2, and I did not change the user account.