Knowledge Management

Where is the proper location of user-prefs.conf?

ddrillic
Ultra Champion

All along we used to associate the user role to its default app at /opt/splunk/etc/shcluster/apps/user-prefs/local/user-prefs.conf on the deployer.

After the upgrade to 7.x we get the message -

-- Search Head Cluster Deployer: The configuration bundle contains the following default apps: SplunkForwarder, SplunkLightForwarder, framework, gettingstarted, introspection_generator_addon, launcher, learned, legacy, sample_app, search, user-prefs.

The question is derived from Why can't I push SH bundles?.

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

Hello @ddrillic,

the apps mentioned above, are native to splunk and exists in any new splunk install.
these apps can not be pushed in a bundle from deployer to search head cluster members.
with that being said, you can take you user-prefs.conf file and place it in a new app and push to members.
read more in this article:
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/Migratefromstandalonesearchheads#Do_not...

hope it helps

View solution in original post

adonio
Ultra Champion

Hello @ddrillic,

the apps mentioned above, are native to splunk and exists in any new splunk install.
these apps can not be pushed in a bundle from deployer to search head cluster members.
with that being said, you can take you user-prefs.conf file and place it in a new app and push to members.
read more in this article:
http://docs.splunk.com/Documentation/Splunk/7.0.1/DistSearch/Migratefromstandalonesearchheads#Do_not...

hope it helps

ddrillic
Ultra Champion

@adonio - for one thing this change in 7.x is not backward compatible as this feature of pushing the default user-prefs app has been working for us for years.

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...