Splunk delete command is not working

Available Languages

Updated:September 30, 2026
Document ID:SPLK050224

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud

Description

Using the delete command to delete specific events is not working and giving the following ""Error in 'delete' command: You have insufficient privileges to delete events" There may also be a message about "The search job has failed due to an error. You may be able view the job in the Job Inspector"Error message  
NOTE: The error message can display slightly differently on other version of Splunk.

Investigation

If a user does not have "can_delete" role associated with their user profile they will receive this message.

You can verify a user's roles in Splunk app via Settings > Roles > roles will be listed here.

Screen Shot 2023-03-01 at 8.31.20 AM.png
 

Resolution

Users can add the  "can_delete" role to their profile in the Splunk app via Settings > User and then associate the role with the user.  


Screen Shot 2023-02-28 at 1.14.20 PM.png
NOTE: You will also need to check the "I acknowledge that users assigned to roleswith the fsh_manage capability can send search results data outside the compli-"

Revision History

Revision Publish Date Comments
1.0
30-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles