So the user is basically the non-user, the absence of user, not-any-user.
This is a discussion linked to the permission system on Splunk Knowledge Objects, these object can be pretty much anything: savedsearches, views, users, macros…
Now you will notice that nobody is usually the owner of some resources when installing an app.
find /opt/splunk/etc/ -type f -name *.meta | xargs egrep nobody | uniq
./splunk/etc/apps/Splunk_TA_nix/metadata/local.meta:owner = nobody
./splunk/etc/apps/sample_app/metadata/default.meta:owner = nobody
./splunk/etc/apps/threatstream/metadata/default.meta:owner = nobody
./splunk/etc/apps/maps/metadata/default.meta:owner = nobody
In the scenario of savedsearches running, when that search owned by 'nobody' is run, no user specific quotas will be applied, instead only the default quotas will be applied.
authorize.conf default file as a good example. ( $SPLUNK_HOME/etc/system/default/authorize.conf )
There we list capabilities and roles (default ones of course - not to be ever modified!)
Roles are mapped one to many to capabilities.
Users inherits capabilities through role assignment.
For the 'nobody' user, a role can't be assigned then the default settings will apply, in the specific context of searches:
[default]
cumulativeRTSrchJobsQuota = 100
cumulativeSrchJobsQuota = 50
rtSrchJobsQuota = 6
schedule_rtsearch = enabled
srchDiskQuota = 100
srchJobsQuota = 3
srchMaxTime = 100days
p.s. info above based on 6.x - should apply to some extent to earlier version too
