https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350095#M12461 <P>I didn't create a user, as you said it is the user (no-user) of the Splunk-free version.<BR /> I modified the license from trial to free.</P> <P>In he Admin Manual, about free version, there is not a description of the enabled capabilities.<BR /> I expected that even if there is not role management the events access/deletion could be managed.</P> Thu, 03 Aug 2017 15:14:50 GMT Alive77 2017-08-03T15:14:50Z https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350092#M12458 <P>I just installed Splunk 6.6.2 free.<BR /> Is there a way to modify free user capability, in my situation I would like disable delete capability.</P> <P>At this moment, I create a new user and i'm able to delete events using CLI, with command:</P> <P>index= somethingtodelete | delete</P> <P>Thanks in advance.</P> Thu, 03 Aug 2017 13:47:27 GMT https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350092#M12458 Alive77 2017-08-03T13:47:27Z https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350093#M12459 <P>Hi there, edit the capabilities of the role related to that user or check if role user ineherits can_delete capability from other role.</P> Thu, 03 Aug 2017 14:40:48 GMT https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350093#M12459 alemarzu 2017-08-03T14:40:48Z https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350094#M12460 <P>If you are using the free Enterprise trial, then check alemarzu's suggestion.</P> <P>If you are using Splunk Free, then there is no user or role management (see <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/MoreaboutSplunkFree">About Splunk Free</A> in the <EM>Admin Manual</EM>).</P> <P>The fact that you could create a user account suggests that you are using the 60-day free Enterprise trial, which is what you get when you first download and install Splunk Enterprise.</P> Thu, 03 Aug 2017 14:55:50 GMT https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350094#M12460 ChrisG 2017-08-03T14:55:50Z https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350095#M12461 <P>I didn't create a user, as you said it is the user (no-user) of the Splunk-free version.<BR /> I modified the license from trial to free.</P> <P>In he Admin Manual, about free version, there is not a description of the enabled capabilities.<BR /> I expected that even if there is not role management the events access/deletion could be managed.</P> Thu, 03 Aug 2017 15:14:50 GMT https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350095#M12461 Alive77 2017-08-03T15:14:50Z https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350096#M12462 <P>Quoting from that topic: "All accesses are treated as equivalent to the admin user. There is only one role (admin), and it is not configurable. You cannot add more roles or create user accounts." The admin role has all the capabilities listed <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Security/Rolesandcapabilities">here</A>, and you cannot configure or manage them under the free license.</P> Thu, 03 Aug 2017 15:44:05 GMT https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350096#M12462 ChrisG 2017-08-03T15:44:05Z https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350097#M12463 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/12657">@ChrisG</a> that's not true. According the manual, Admin has not the delete_by_keyword capability. In Splunk Free this capability is active.</P> Tue, 29 Sep 2020 15:14:30 GMT https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350097#M12463 Alive77 2020-09-29T15:14:30Z https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350098#M12464 <P>Good correction, thank you!</P> Fri, 04 Aug 2017 15:32:31 GMT https://community.splunk.com/t5/Security/Splunk-free-and-capability/m-p/350098#M12464 ChrisG 2017-08-04T15:32:31Z