Splunk Dev

Is there any effects, if ownership of savedsearches is "nobody"?

yutaka1005
Builder

I believe that if ownership is nobody, it runs as role splunk-system-user, and splunk-system-user Inherits role admin, so it runs as admin.

Of course, if savedsearches contain knowledge objects(*macro, eventtype, lookup table etc...) that are private permittion of other user, it will be fail.

But in other cases, is my understanding that there is no particular influence is correct?

0 Karma

dkeck
Influencer

HI,

I can´t find it anymore, but I once read that searches running as nobody will have a lower priority for the scheduler.

But since nobody is often applied as user for e.g. apps, when they get installed, I don´t see any reason to change this. Never had any bad experience with user nobody.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...