topic How do I set default conf files for new users? in Security

How do I set default conf files for new users?

stevennoble — Wed, 18 Dec 2013 00:39:46 GMT

When ever I create a new user I'd like to have some default rules in there search/local/ui-prefs.conf file. Is there a template which is copied for new users?

Re: How do I set default conf files for new users?

jtrucks — Wed, 18 Dec 2013 13:06:17 GMT

You can create this file in $SPLUNK_HOME/etc/system/local if you want to force defaults for all users. Individuals accounts can, of course, have different options, as well.

Re: How do I set default conf files for new users?

dmaislin_splunk — Wed, 18 Dec 2013 13:15:13 GMT

I would setup Active Directory or LDAP authentication:

http://docs.splunk.com/Documentation/Splunk/6.0/Security/SetupuserauthenticationwithLDAP

Then I would create all the groups in AD and create roles in Splunk. Then you can easily manage the default user behavior in the Splunk roles.

I would then create an app and put that as their default app as well. Finally, you don't just have to put the ui-prefs.conf in system/local, you can put it in each [appname]/default or [appname]/local.