Since upgrading to 6.3.0 I have been getting a popup asking me to take a search tour but would like to disable this for all users.
Added the following configuration to $SPLUNK/etc/system/local/ui-tour.conf and restarted splunk.
[search-tour]
viewed = 1
Block all tours (including dashboards) using:
[default]
useTour = false
Note: our reverse proxy (for authentication) doesnt allow the %3A (colon) in the URL for the dashboard tour
Added the following configuration to $SPLUNK/etc/system/local/ui-tour.conf and restarted splunk.
[search-tour]
viewed = 1