You can set a default App, either per user or globally. This App displays by default every time you log into Splunk.
Create a file called user-prefs.conf in the user's local directory (to apply to a user):
Or in the user-prefs App directory (to apply globally):
Add the following to the user-prefs.conf file:
default_namespace = app_name
Note: The App name is case-sensitive.
Restart Splunk to load your new configuration.
Example For example, set the default App for the admin user to the Search App:
For the test user, it would be in
Add the following:
default_namespace = search
In 4.1, the default app setting will be configurable through Manager.
To set the default app for a particular user:
To set a default app by role:
For 4.1, to set a GLOBAL default app, which in my example below is the 'search' app, you'll need to specify the following in $SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf :
[general_default] default_namespace = search
Wolverine has the key element here. The Splunk documentation says that you simply need to add "defaultnamespace = search" to the user-prefs.conf stanza, but this did not work for me. Once I included the above configuration as part of the [generaldefault] stanza, and then restarted splunk, I was able to see the Search app by default.
This is not working for me under 4.1, ewoo. I've tried setting this via the manager and also via the user-prefs.conf but for some reason it doesn't take effect. Was there by any chance a change made in 4.1 to store user prefs in a db table instead of in flat files?
We store user preferences similarly in 4.0.x and 4.1. The biggest difference is that we now support per-role default apps, which required some additions to user-prefs.conf.
Definitely no storage to a database, however.
What specifically is not working for you? Are you trying to edit the conf files directly, or are you using Manager? Are you trying to set a default app for a specific user, a specific role, or everyone?