Building for the Splunk Platform

Is there any effects, if ownership of savedsearches is "nobody"?


I believe that if ownership is nobody, it runs as role splunk-system-user, and splunk-system-user Inherits role admin, so it runs as admin.

Of course, if savedsearches contain knowledge objects(*macro, eventtype, lookup table etc...) that are private permittion of other user, it will be fail.

But in other cases, is my understanding that there is no particular influence is correct?

0 Karma



I can´t find it anymore, but I once read that searches running as nobody will have a lower priority for the scheduler.

But since nobody is often applied as user for e.g. apps, when they get installed, I don´t see any reason to change this. Never had any bad experience with user nobody.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...