Editorial question25.4K views1,296 votes0 answers4,012 following
AI-generatedSplunk delete capability lacks per-index permission boundary
Permission scope for the delete command The delete capability in authorize.conf is a global grant with no per-index restriction. A role that holds delete can run the | delete search command against any index listed in that role's srchIndexesAllowed or srchIndexesDefault . This means widening search access to additional indexes automatically widens deletion a
splunk