We have real-time search disabled for "users". We still see a few real-time searches by some users (they aren't power users, they aren't admins). Running 4.2.4.
Is there a way for a user to override access to real-time search?
--- deleted.. posted on wrong thread
I do not understand your question clearly, but you can change user role if you want. Please refer to following doc.
http://docs.splunk.com/Documentation/Splunk/4.2.3/admin/Addandeditroles
