Security

Who do saved scheduled searches run as?

juniormint
Communicator

I'm trying to figure out how to have a saved search editable by all the people in a role without creating an opportunity for privileged escalation. This led me to ask questions around who a saved search run's as.

How does it work? Is it the owner? If yes, what if no owner is specified?

I think I would like it to be something like specify a role that it runs as. Is something like that doable?

1 Solution

somesoni2
Revered Legend

The saved searches run as the user who owns it. If no owner is specified (No owner is shown in UI or nobody in .meta files), it runs as splunk-system-user account. If you want searches to run as a role, you need to create a user (can keep the same name as the role) having that role and change the owner of the search with that role (by updating owner property in local.meta file).

View solution in original post

woodcock
Esteemed Legend

NEW FEATURE UPDATE! See documentation here:

http://docs.splunk.com/Documentation/Splunk/6.3.1511/Report/Createandeditreports

5. (Optional) Determine whether the search should run as Owner or run as User.

This setting determines whether the search runs with the permissions of the search Owner (the person who defined the search) or the permissions of the search User (the person who is running the search). Reports run as Owner by default.

For a detailed explanation of why this setting is significant and how it works, see "Running reports as the report owner or report user," in this topic.

http://docs.splunk.com/Documentation/Splunk/6.3.1511/Report/Createandeditreports#Determine_whether_t...

somesoni2
Revered Legend

The saved searches run as the user who owns it. If no owner is specified (No owner is shown in UI or nobody in .meta files), it runs as splunk-system-user account. If you want searches to run as a role, you need to create a user (can keep the same name as the role) having that role and change the owner of the search with that role (by updating owner property in local.meta file).

juniormint
Communicator

what access does splunk-system-user have? Is it like god access?

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...