Dashboards & Visualizations

How do i set the default App in splunk?

Erik_Swan
Splunk Employee
Splunk Employee

I want to bypass the launcher screen..

Tags (3)
1 Solution

ewoo
Splunk Employee
Splunk Employee

In 4.1, the default app setting will be configurable through Manager.

To set the default app for a particular user:

  • Go to Manager > Users
  • Click a user (e.g. yourself)
  • Choose an app in the 'Default app' dropdown
  • Save

To set a default app by role:

  • Go to Manager > Roles
  • Click a role (e.g. admin)
  • Choose an app in the 'Default app' dropdown
  • Save

View solution in original post

maicalljason
New Member

This is not working for me under 4.1, ewoo. I've tried setting this via the manager and also via the user-prefs.conf but for some reason it doesn't take effect.herve leger Was there by any chance a change made in 4.1 to store user prefs in a db table instead of in flat files?

0 Karma

treyka
Path Finder

This is not working for me under 4.1, ewoo. I've tried setting this via the manager and also via the user-prefs.conf but for some reason it doesn't take effect. Was there by any chance a change made in 4.1 to store user prefs in a db table instead of in flat files?

0 Karma

ewoo
Splunk Employee
Splunk Employee

We store user preferences similarly in 4.0.x and 4.1. The biggest difference is that we now support per-role default apps, which required some additions to user-prefs.conf.

Definitely no storage to a database, however.

What specifically is not working for you? Are you trying to edit the conf files directly, or are you using Manager? Are you trying to set a default app for a specific user, a specific role, or everyone?

0 Karma

muebel
SplunkTrust
SplunkTrust

See my comment on wolverine's answer.

0 Karma

the_wolverine
Champion

For 4.1, to set a GLOBAL default app, which in my example below is the 'search' app, you'll need to specify the following in $SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf :

[general_default]
default_namespace = search

swdonline
Path Finder

In 4.2.4 Free License this does not seem to work.

0 Karma

the_wolverine
Champion

Muebel, Thanks for catching that! I've corrected the doc so we don't have anymore confusion: http://www.splunk.com/base/Documentation/4.1.1/Admin/Whatsanapp#Bypass_the_Launcher_for_all_users

0 Karma

muebel
SplunkTrust
SplunkTrust

Wolverine has the key element here. The Splunk documentation says that you simply need to add "default_namespace = search" to the user-prefs.conf stanza, but this did not work for me. Once I included the above configuration as part of the [general_default] stanza, and then restarted splunk, I was able to see the Search app by default.

ewoo
Splunk Employee
Splunk Employee

In 4.1, the default app setting will be configurable through Manager.

To set the default app for a particular user:

  • Go to Manager > Users
  • Click a user (e.g. yourself)
  • Choose an app in the 'Default app' dropdown
  • Save

To set a default app by role:

  • Go to Manager > Roles
  • Click a role (e.g. admin)
  • Choose an app in the 'Default app' dropdown
  • Save

Erik_Swan
Splunk Employee
Splunk Employee

You can set a default App, either per user or globally. This App displays by default every time you log into Splunk.

Configuration

  1. Create a file called user-prefs.conf in the user's local directory (to apply to a user):

    $SPLUNK_HOME/etc/users//user-prefs/local/user-prefs.conf

    Or in the user-prefs App directory (to apply globally):

    $SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf

  2. Add the following to the user-prefs.conf file:

    default_namespace = app_name

    Note: The App name is case-sensitive.

  3. Restart Splunk to load your new configuration.

Example For example, set the default App for the admin user to the Search App:

  1. Edit $SPLUNK_HOME/etc/users/admin/user-prefs/local/user-prefs.conf. For the test user, it would be in $SPLUNK_HOME/etc/users/test/user-prefs/local/user-prefs.conf

  2. Add the following:

        default_namespace = search
    
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...