Scheduled job failure

[ITSplunk117]

I have a few scheduled jobs running from an TA.  Multiple ones have | collect index=summary at the end of the SPL.  For some of them when they run I get 0 results with a warning "no results to summary index".  I reran the job manually and can see the results.  I can see there's a macro error in the job that did not have any results but the other job that ran has very similar SPL and works fine.

When I looked at search.log the one thing that stood out is for the one that ran with results. This was in the log user context: Splunk-system-user

The job that did not return results did not have "user context: Splunk-system-user" my question is what sets the user context and what overrides it (if possible) to see if this is the cause of my problems.

thanks

[richgalloway]

The user context is the name of account under which the job runs.  In most cases, it's the name of user running the search, but some scheduled searches can be set to run as the owner.  In the specific case of user context = splunk-system-user, that is the name used when a search has no owner (owned by "nobody").

[ITSplunk117]

Thanks, 

It does tho I'm going to have to take a closer look at the reports.  They at least appear to have the same owner nobody and run as Owner.  Also the Read/Write permissions are the same.