Can I continue to delete files on Splunk Free Edition

[kenknee]

Hi, I'm currently using Splunk Enterprise Trial Edition, and I got to know that Splunk Free does not have Access control feature for it. I wonder Splunk Free would allow me to delete the log files after indexing just as like Admin with can_delete privilege?

[cpt12tech]

Is this true with the latest version? 6.2? I'm not able to pipe a search into the delete. It says it's deleted but if I refresh the search the data is still there. I can't check the user roles in the free version to see if I have delete access?

[Ayn]

This feature is available to the Admin user in the free edition as well.

You should note though that the delete operator doesn't actually delete the log files themselves, rather it marks events in Splunk's index as deleted. Also as it only marks them as deleted rather than deleting them for real, you won't immediately recover any disk space by running delete. Events that are marked as deleted will however be totally removed when events are moved to cold index (think of it as archiving).