Archive

Some users inheriting default app from "system" when they are part of roles for setting the default app

Communicator

I've been creating roles specifically for setting the default app for users in that role. I have also cleared the default app for all standard Splunk roles (admin, power, user).

For whatever reason, some of my users are inheriting the default app from "system", while others inherit from the roles created to apply a default app. These users are part of the same roles. Is there a user setting somewhere that specifies inheritance or default app setting? It would be nice to know the conf file too for where a user defined default app is set.

Tags (1)
0 Karma
1 Solution

Esteemed Legend

When a user picks his own app, it is stored as default_namespace in the [general] stanza here:

$SPLUNK_HOME/etc/users/<Some User ID Here>/user-prefs/local/user-prefs.conf

View solution in original post

Esteemed Legend

When a user picks his own app, it is stored as default_namespace in the [general] stanza here:

$SPLUNK_HOME/etc/users/<Some User ID Here>/user-prefs/local/user-prefs.conf

View solution in original post

Communicator

This was it! Thank you, @woodcock!

0 Karma

Esteemed Legend

Users may override your setting with their own personal-level settings and there is nothing that you can do about that.

0 Karma

Communicator

I downvoted this post because not helpful - not technical.

0 Karma

Communicator

@woodcock, totally agree. I'm trying to clear the user's selection - specifically my own. In Splunk Web, there's no option to deselect the default app, and inherit from roles. Once you select a custom default app, I can't find how to clear that selection. It would also be useful to know what config file would have this custom setting as well.

0 Karma