What is meant by one user for the free version of Splunk?

[stevecrow]

Hi,

What is meant by "one user" for the free version of Splunk? I'm planning on one receiver at the moment, with 3-4 forwarders. I'm looking forward to trying it out!

Steve

[stevecrow]

We are a small two man operation. Only one of us would ever be logged on at one time. Is the Splunk user interface Web based? So we can login from anywhere on the network? I was anticipating just using Splunk from the server console or RDP session.

Thank you again,
Steve

[ChrisG]

Yes, there is a web interface. You might want to go through the Search Tutorial, which will take you through the UI using a sample data set.

[dmarling · Accepted solution]

Hi Steve,

The free license does not allow you to create multiple users, but if you are just trying it out the 30 day enterprise license does allow multiple users to be created. Once the free license expires the admin account will be the only account that functions. The comparison chart here: https://www.splunk.com/en_us/software/features-comparison-chart.html shows the differences between the different options.

Access Control you will see is not an option on Splunk Free.

[ChrisG]

For more details, see About Splunk Free in the Splunk Enterprise Admin Manual. It says:

There is no authentication or user and role management when using Splunk Free. This means:

• There is no login. The command line or browser can access and control all aspects of Splunk Free with no user and password prompt.
• All accesses are treated as equivalent to the admin user. There is only one role (admin), and it is not configurable. You cannot add more roles or create user accounts.
• Searches are run against all public indexes, 'index=*'.
• Restrictions on search, such as user quotas, maximum per-search time ranges, and search filters, are not supported.
• The capability system is disabled. All available capabilities are enabled for all users accessing Splunk Free.

[stevecrow]

Thank you very much, this adds much more clarity to the situation.

[stevecrow]

We are a small two man operation. Only one of us would ever be logged on at one time. Is the Splunk user interface Web based? So we can login from anywhere on the network? I was anticipating just using Splunk from the server console or RDP session.

Thank you again,
Steve