topic Re: Who do saved scheduled searches run as? in Security

Who do saved scheduled searches run as?

juniormint — Tue, 07 Oct 2014 18:30:17 GMT

I'm trying to figure out how to have a saved search editable by all the people in a role without creating an opportunity for privileged escalation. This led me to ask questions around who a saved search run's as.

How does it work? Is it the owner? If yes, what if no owner is specified?

I think I would like it to be something like specify a role that it runs as. Is something like that doable?

Re: Who do saved scheduled searches run as?

somesoni2 — Tue, 07 Oct 2014 20:58:20 GMT

The saved searches run as the user who owns it. If no owner is specified (No owner is shown in UI or nobody in .meta files), it runs as splunk-system-user account. If you want searches to run as a role, you need to create a user (can keep the same name as the role) having that role and change the owner of the search with that role (by updating owner property in local.meta file).

Re: Who do saved scheduled searches run as?

juniormint — Wed, 08 Oct 2014 03:56:52 GMT

what access does splunk-system-user have? Is it like god access?

Re: Who do saved scheduled searches run as?

woodcock — Wed, 13 Jan 2016 16:10:27 GMT

NEW FEATURE UPDATE! See documentation here:

http://docs.splunk.com/Documentation/Splunk/6.3.1511/Report/Createandeditreports

5. (Optional) Determine whether the search should run as Owner or run as User.

This setting determines whether the search runs with the permissions of the search Owner (the person who defined the search) or the permissions of the search User (the person who is running the search). Reports run as Owner by default.

For a detailed explanation of why this setting is significant and how it works, see "Running reports as the report owner or report user," in this topic.

http://docs.splunk.com/Documentation/Splunk/6.3.1511/Report/Createandeditreports#Determine_whether_to_run_reports_as_the_report_owner_or_report_user