I've enabled LDAP authentication on my search head not so long ago and I started to get errors claiming that
08-08-2018 10:56:21.732 +0300 INFO AuthenticationManagerLDAP - Could not find user="nobody" with strategy="LDAP_dc01"
As far as I understand from reading other answers to similar issues, on some particular activity (e.g., saved search) Splunk takes owner from metadata/local.meta or metadata/default.meta and searches for that user. Since it doesn't find that user in LDAP, it reports this fact in log file.
Well, I've searched through my *.meta files and found quite a number of instances where "owner = nobody" has been mentioned. I have the impression that this "owner = nobody" was (or maybe still is) used from time to time at least in earlier versions. So it's not clear for me now if that log message indicates some problem (e.g., saved search cannot be started) or can it safely be ignored. Or maybe I should go through these meta files and change owner to something else? Please advise.
Try assigning a valid Splunk account owner or try cloning via the UI, then delete the original. I usually get these from developers editing savedsearches.conf via vi command line instead of using the UI. Also note that searches running as nobody/no owner will have a lower priority for the scheduler.