Getting Data In

Why does the author appear as "nobody" from this search?


hi all~

| rest /services/apps/local

author is nobody

How do I find the real author?

alt text

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

After a user's account is deleted, all their artifacts will show up as owned by "Nobody". If you check the scheduled searches/reports, you may find there are ones that belong to "Nobody", and if you are running Splunk 6.6 or above, you can reassign the report to a different owner.

0 Karma