Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Platform
- :
- Splunk Cloud Platform
- :
- Can service account be used as owner of Knowledge ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can service account be used as owner of knowledge objects(saved searches, transforms-lookups, props-extracts, macros, and views)?Please share pros and cons.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you can use service user for own KOs and e.g. run those with schedules. Actually I prefer this way if possible. Probably most important thing is that usually service users don’t leave company. When normal user leave and he/she have scheduled searches, alerts etc those doesn’t work after user has removed or his/her roles are removed. Another advantage is that you could add some capabilities which you want give to normal user or those could have more resources. This also means that alerts etc don’t use user quota etc.
A negative thing is that when no one owns those KOs there could be lot of unnecessary and unused KOs and even some scheduled alerts, reports etc. running for long time and using resources.
Anyhow I see that there are more advantages to use those than avoiding those. Usually I prefer to use several service users with different integrated source systems and with different roles assigned to those svc users.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you can use service user for own KOs and e.g. run those with schedules. Actually I prefer this way if possible. Probably most important thing is that usually service users don’t leave company. When normal user leave and he/she have scheduled searches, alerts etc those doesn’t work after user has removed or his/her roles are removed. Another advantage is that you could add some capabilities which you want give to normal user or those could have more resources. This also means that alerts etc don’t use user quota etc.
A negative thing is that when no one owns those KOs there could be lot of unnecessary and unused KOs and even some scheduled alerts, reports etc. running for long time and using resources.
Anyhow I see that there are more advantages to use those than avoiding those. Usually I prefer to use several service users with different integrated source systems and with different roles assigned to those svc users.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@isoutamo Thanks for sharing your insights, this is helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @msatish
Yes - A service account can be used in the same way any other user, infact I always recommend that knowledge objects *should* be owned by a service account because otherwise if owned by a user which leaves the organisation then the knowledge objects could become orphaned - or they could accidentally be deleted.
If using SAML (for example) with Authentication Extensions enabled then users will be automatically updated based on groups/roles in the Identity Provider - so if they leave their account will be deleted. If they move teams then they may have more/less permissions than they used to.
🌟 Did this answer help you? If so, please consider:
- Adding kudos to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@livehybrid Thanks for sharing your insights, this is helpful.
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
