Splunk Dev

Is there any effects, if ownership of savedsearches is "nobody"?

yutaka1005
Builder

I believe that if ownership is nobody, it runs as role splunk-system-user, and splunk-system-user Inherits role admin, so it runs as admin.

Of course, if savedsearches contain knowledge objects(*macro, eventtype, lookup table etc...) that are private permittion of other user, it will be fail.

But in other cases, is my understanding that there is no particular influence is correct?

0 Karma

dkeck
Influencer

HI,

I can´t find it anymore, but I once read that searches running as nobody will have a lower priority for the scheduler.

But since nobody is often applied as user for e.g. apps, when they get installed, I don´t see any reason to change this. Never had any bad experience with user nobody.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...