Log-based detector access and ownership
Understand how permissions, connections, owners, and scheduled search runners control log-based detectors.
Permissions
The built-in o11y_admin and o11y_power roles receive permissions to create, update, and delete log alerts by default.
Creating, editing, previewing, and investigating use the current user's Splunk permissions. A user cannot use the workflow to retrieve log data that the user is not authorized to view.
Connections and scheduled searches
For Unified Identity, scheduled evaluations use either an explicitly stored user or an administrator-configured alert service account. For Log Observer Connect, scheduled evaluations use the service account associated with the selected connection.
Permission to view a fired alert does not grant permission to load raw events, run the search, or open the data in Log Observer.
Created by and Owner
Created by is retained for historical attribution. Owner identifies the user responsible for maintaining the detector and can be reassigned.
Owner removal
| Execution mode | Result when the owner is deleted |
|---|---|
| Unified Identity user execution, with the same user as owner and search runner | The detector remains enabled and scheduled evaluations fail. |
| Unified Identity alert service account | The detector becomes unassigned, but scheduled evaluations continue while the service account remains available. |
| Log Observer Connect service account | The detector becomes unassigned, but scheduled evaluations continue while the connection service account remains available. |
An administrator can assign a new owner without recreating the detector or changing its history. Reassigning the owner does not change a separate service-account search runner.