Getting Data In

Delete Command Permissions - Specific Index

snoobzilla
Builder

We are working on a utility to selectively push data into a summary index. Of CRUD operations we do not have Delete.

I would like to have users be able to use delete command against a that summary index, but not others. Is this possible?

Docs indicate the can_delete role is command specific. Is it possible to allow delete only for a specific index? Maybe clone the can_delete role and give it rights to only to a specific index?

0 Karma
1 Solution

dturnbull_splun
Splunk Employee
Splunk Employee

Using |delete depends on ability to search, so you could create a seperate user & role that has only permissions to a single index and includes the can_delete role.

It's not possible to selectively limit | delete

If your data is changing, it's possibly better suited to the KV Store.

View solution in original post

dturnbull_splun
Splunk Employee
Splunk Employee

Using |delete depends on ability to search, so you could create a seperate user & role that has only permissions to a single index and includes the can_delete role.

It's not possible to selectively limit | delete

If your data is changing, it's possibly better suited to the KV Store.

snoobzilla
Builder

Thanks for the info, will forward to my admin.

0 Karma
Get Updates on the Splunk Community!

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...