Question about "run as" (Owner or User ) for saved searches. Missing in version 7.

[the_wolverine]

• It looks like as of version 7, the user is no longer able to edit this setting (Run as Owner vs User). It has moved to Advanced Edit which may be available only to admins.

1 - Does run as "Owner" bypass index access security? Assuming the saved search is readable by a user, that user does not need access to the data to run the search and see results?

2 - Since the saved search is configured to run as "Owner", the Owner's quota will be consumed when the search is run?

The saved search spec describes this setting in:
https://docs.splunk.com/Documentation/Splunk/7.2/Admin/Savedsearchesconf (I believe there is no change for this particular feature since version 6.6)

[the_wolverine · Accepted solution]

The setting was never removed in version 7. After months of dealing with the loss and non-working solutions, I discovered on my own that it had been relocated to "Edit Permission". The search will always run as Owner if is scheduled (makes sense). When configured as a saved search (not scheduled), the owner can set "Run As" to Owner or User via the Edit Permission.

[ben_leung]

Hi wolverine,

1. Yea, so for example if you have an admin role user create a saved search with index=_internal and have it run as owner, while sharing it to all roles, a regular user will be able to see the data.

2. Yea, so if the owners is in the admin role, the admin role's quota will be consumed.