In the UI I navigate to Jobs and see entries identified as Owner "splunk-system-user" why is that?
If the owner is shown as "Splunk Dispatcher (splunk-system-user)", this means the scheduler ran a job due to a scheduled saved search for which your role has access to view.
In 4.1, the owner is just "splunk-system-user".
View solution in original post
Jobs that are run as "splunk-system-user" are scheduled searches with no owner specified. If you need to specify an owner for these jobs, refer to the following answer.