https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119899#M3681 <P>I want to be able to prevent some users from using the <CODE>collect</CODE> command. How to do that? Is there a capability that controls whether or not a user has permission to run <CODE>collect</CODE>?</P> Wed, 01 Apr 2015 05:00:19 GMT ben363 2015-04-01T05:00:19Z https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119899#M3681 <P>I want to be able to prevent some users from using the <CODE>collect</CODE> command. How to do that? Is there a capability that controls whether or not a user has permission to run <CODE>collect</CODE>?</P> Wed, 01 Apr 2015 05:00:19 GMT https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119899#M3681 ben363 2015-04-01T05:00:19Z https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119900#M3682 <P>This is not currently possible. See: <A href="http://answers.splunk.com/answers/128764/restrict-a-users-ability-to-write-to-indexes.html">http://answers.splunk.com/answers/128764/restrict-a-users-ability-to-write-to-indexes.html</A></P> Wed, 01 Apr 2015 20:57:12 GMT https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119900#M3682 masonmorales 2015-04-01T20:57:12Z https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119901#M3683 <P>Verified that the collect command is connected to the authorize.conf permission [capability::indexes_edit]</P> Mon, 04 Jun 2018 16:02:53 GMT https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119901#M3683 alanden_splunk 2018-06-04T16:02:53Z https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119902#M3684 <P>ok, this is an old topic and it seems at that time of 2015 this feature was not there..</P> <P>and now, authorize.conf gives a way to grant/remove this collect command from a user... </P> <P>[capability::run_collect]<BR /> * Lets a user run the collect command.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Authorizeconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Authorizeconf</A></P> <P>(at this time of this writing the current splunk version is 7.1.2)</P> Wed, 22 Aug 2018 11:51:18 GMT https://community.splunk.com/t5/Security/How-do-I-prevent-some-users-from-running-the-collect-command/m-p/119902#M3684 inventsekar 2018-08-22T11:51:18Z