topic Re: What does 'nobody' (under owner column) signify in Splunk search and reporting? in Splunk Search

What does 'nobody' (under owner column) signify in Splunk search and reporting?

saikatr — Fri, 08 Jul 2016 13:21:00 GMT

Probably a silly question, but can someone please advise what 'nobody' (under Owner column) next to a dashboard signifies in Splunk? If an artifact is created it reflects the owner's i.d. as configured in the 'Users' section generally, but there seem to be a lot of objects with 'nobody' as owner in our Splunk instance. What does that mean?

Re: What does 'nobody' (under owner column) signify in Splunk search and reporting?

woodcock — Fri, 08 Jul 2016 13:30:38 GMT

It means that the user that created the object is no longer a user in the authenticating system. If you create a local user, then login as that user, then create any knowledge object, then delete that user, then all of his KOs will switch to be owned by nobody.

Re: What does 'nobody' (under owner column) signify in Splunk search and reporting?

saikatr — Fri, 08 Jul 2016 13:47:45 GMT

Makes perfect sense. Many thanks for clarifying.

Re: What does 'nobody' (under owner column) signify in Splunk search and reporting?

bandit — Sat, 26 Aug 2017 18:56:45 GMT

Thanks for the info @woodcock I have a bunch of these from folks who have copied apps in from other search heads. I was able to get the default owner set like below in metadata/local.meta and I see savedsearches.conf objects in UI no longer have the nobody owner next to them. Even after a restart of the search head, I still see the scheduler running these as nobody. So possibly I still have to set at the object level for the scheduler to use the new owner?

#metadata/local.meta
    []
    owner = newowner

Re: What does 'nobody' (under owner column) signify in Splunk search and reporting?

woodcock — Sun, 27 Aug 2017 13:01:38 GMT

This only applies if your object does not already have an owner= defined. In your case (actually, in every case where a knowledge object has been created or modified from the GUI), it already has it's own value so it will not inherit the default value that you have defined in local.meta. The way that this works is, as an app developer (do not over-glorify app; this just means a packaging of configuration files to be deployed together), I can dispense with putting an owner=newowner line under every Knowledge Object definition and instead put owner=newowner once inside of local.meta. If Splunk does not find an owner= line in the Knowledge Object definition stanza, it will use the one from local.meta (if it exists).