Reporting

Why do I see an Owner = Splunk Dispatcher (splunk-system-user) in the Jobs managment view?

Ellen
Splunk Employee
Splunk Employee

In the UI I navigate to Jobs and see entries identified as Owner "splunk-system-user" why is that?

Tags (2)
1 Solution

Ellen
Splunk Employee
Splunk Employee

If the owner is shown as "Splunk Dispatcher (splunk-system-user)", this means the scheduler ran a job due to a scheduled saved search for which your role has access to view. In 4.1, the owner is just "splunk-system-user".

View solution in original post

the_wolverine
Champion

Jobs that are run as "splunk-system-user" are scheduled searches with no owner specified. If you need to specify an owner for these jobs, refer to the following answer.

Ellen
Splunk Employee
Splunk Employee

If the owner is shown as "Splunk Dispatcher (splunk-system-user)", this means the scheduler ran a job due to a scheduled saved search for which your role has access to view. In 4.1, the owner is just "splunk-system-user".

Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...