Reporting
Highlighted

Why do I see an Owner = Splunk Dispatcher (splunk-system-user) in the Jobs managment view?

Splunk Employee
Splunk Employee

In the UI I navigate to Jobs and see entries identified as Owner "splunk-system-user" why is that?

Tags (2)
Highlighted

Re: Why do I see an Owner = Splunk Dispatcher (splunk-system-user) in the Jobs managment view?

Splunk Employee
Splunk Employee

If the owner is shown as "Splunk Dispatcher (splunk-system-user)", this means the scheduler ran a job due to a scheduled saved search for which your role has access to view. In 4.1, the owner is just "splunk-system-user".

View solution in original post

Highlighted

Re: Why do I see an Owner = Splunk Dispatcher (splunk-system-user) in the Jobs managment view?

Champion

Jobs that are run as "splunk-system-user" are scheduled searches with no owner specified. If you need to specify an owner for these jobs, refer to the following answer.