topic Re: Is it possible to have alerts and reports assigned to nobody as owner? in Splunk Enterprise

Is it possible to have alerts and reports assigned to nobody as owner?

Gregski11 — Tue, 20 Jun 2023 02:22:11 GMT

would there ever be a scenario where its acceptable to have enabled alerts and or reports running which are not assigned to anybody ie owner = Nobody

Re: Is it possible to have alerts and reports assigned to nobody as owner?

richgalloway — Thu, 22 Jun 2023 13:53:14 GMT

Yes, it is possible to have alerts and reports owned by 'nobody', but I don't know why you'd want to do that. User 'nobody' uses default settings, which may not be correct for the use case. IMO, it's better to assign alerts and reports to a service account with a role that has the resources needed to run those alerts and reports.

Re: Is it possible to have alerts and reports assigned to nobody as owner?

Gregski11 — Thu, 22 Jun 2023 15:57:39 GMT

thank you Rich for taking the time to comment, I agree with you however please check your own config as what I see is that Splunk runs it's own apps as Nobody, for example these:

Splunk_Security_Essentials

SplunkAppForWebAnalytics

Splunk_ML_Toolkit

Splunk_TA_microsoft-cloudservices

Splunk_TA_microsoft-sqlserver

splunk_instrumentation

splunk_monitoring_console

sideview_utils

simple_xml_examples

splunk_archiver

Re: Is it possible to have alerts and reports assigned to nobody as owner?

richgalloway — Thu, 22 Jun 2023 16:00:17 GMT

I understand the use of Nobody is commonplace, but that doesn't mean it's a good idea or that I agree with it.

Re: Is it possible to have alerts and reports assigned to nobody as owner?

isoutamo — Thu, 22 Jun 2023 17:12:28 GMT

Here is explanation what nobody actually means https://community.splunk.com/t5/All-Apps-and-Add-ons/Disambiguation-of-the-meaning-of-quot-nobody-quot-as-an-owner-of/m-p/400573

Based on that, you should always use valid user to own those KOs. User could be a real user or service user depending on your needs.