Getting Data In

Why does the author appear as "nobody" from this search?

hslee
Engager

hi all~

| rest /services/apps/local

author is nobody

How do I find the real author?

alt text

Tags (2)
0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

After a user's account is deleted, all their artifacts will show up as owned by "Nobody". If you check the scheduled searches/reports, you may find there are ones that belong to "Nobody", and if you are running Splunk 6.6 or above, you can reassign the report to a different owner.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...