I am facing two challenges with Splunk 7.2.0.
Thank you for your help
Hi @elsadso ,
admin_all_objects is the only capability through which you can achieve this. In splunk, setting a users' default app can be changed using user Preferences. Only admin can change any user's default app and no one else. What is the use case that any user can change other users' default app ?
Default app from role is inherited because all users must have some app selected as default app. So, splunk will by default have an app inherited from their role, any user can change it from Preferences tab.
For an example, if I create a role and I want all users with xyz app to have default then, I can be control while assigning the role to any user. After that, users' preference is considered highest which will override the inherited app from the role.
Hope this helps 🙂
I upvoted your question because your '2nd challenge' matches mine. It appears to me that the option to NOT select any default app is missing...
Hopefully some Splunk professional takes time to find a more convenient answer.