Unable to delete data with "delete_by_keyword" enabled in the users role

Available Languages

Updated:September 30, 2026

Document ID:SPLK050628

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise/Splunk Cloud

Description

When trying to delete data from an index the following message is seen :

You do not have the capability to delete from index=<index name>

delete_by_keyword is set to enabled for the users role in authorize.conf :

[role_delete_admin]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
delete_by_keyword = enabled << !!!!!
importRoles = admin
srchIndexesAllowed = *;_*
srchIndexesDefault = main
srchMaxTime = 0

Resolution

As well as enabling delete_by_keyword capability you also need to define which indexes the role is allowed to delete from by setting the deleteIndexesAllowed attribute which is required if you enable this option.

authorize.conf.spec

deleteIndexesAllowed = <semicolon-separated list>
* A list of indexes that this role is allowed to delete.
* This setting must be used in conjunction with the 'delete_by_keyword' capability.
* Follows the same wildcarding semantics as the 'srchIndexesDefault' setting.
* No default.

[role_delete_admin]
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
delete_by_keyword = enabled
deleteIndexesAllowed = main   <<< !!
importRoles = admin
srchIndexesAllowed = *;_*
srchIndexesDefault = main
srchMaxTime = 0

The above will allow the role to delete only from the main index in this example.

Alternatively you can import the can_delete role but this will allow deletion within all indexes :