issue with user=nobody with LDAP authentication

[mmasalas]

I've enabled LDAP authentication on my search head not so long ago and I started to get errors claiming that

08-08-2018 10:56:21.732 +0300 INFO  AuthenticationManagerLDAP - Could not find user="nobody" with strategy="LDAP_dc01"

As far as I understand from reading other answers to similar issues, on some particular activity (e.g., saved search) Splunk takes owner from metadata/local.meta or metadata/default.meta and searches for that user. Since it doesn't find that user in LDAP, it reports this fact in log file.

Well, I've searched through my *.meta files and found quite a number of instances where "owner = nobody" has been mentioned. I have the impression that this "owner = nobody" was (or maybe still is) used from time to time at least in earlier versions. So it's not clear for me now if that log message indicates some problem (e.g., saved search cannot be started) or can it safely be ignored. Or maybe I should go through these meta files and change owner to something else? Please advise.

[bandit]

Try assigning a valid Splunk account owner or try cloning via the UI, then delete the original. I usually get these from developers editing savedsearches.conf via vi command line instead of using the UI. Also note that searches running as nobody/no owner will have a lower priority for the scheduler.

[morethanyell]

The solution to mine was to have all scheduled savedsearches to be owned by a service account / savedsearch runner account.

[prakash007]

which version of Splunk are you on..??

we started seeing this messages when we upgraded from 7.0.3 to 7.2.1, take a look at this splunk answer...
https://answers.splunk.com/answers/49525/splunkd-log-error-message.html

find /opt/splunk/ -name local.meta -exec grep nobody {} \; -print

when i ran the above command, most of them were form /etc/apps/learned either from Search Heads or DMC.