This is how I do it. I found this solution a while back when searching on Splunk Answers:
# SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf [general_default] appOrder = app1,app2,app2
This will set the app order for all users.
Please note that if a user explicitly set his own appOrder (via drag and drop) then I believe the user's settings will take precedence. So if the above solution does not immediately work for your user, create a new user and see if it works then.
Also remember to restart Splunk after making changes to configuration files.
On a side note: You can also specify which app is opened automatically when logging into Splunk by setting "default_namespace":
[general_default] appOrder = app1,app2,app2 default_namespace = app1
I am able to implement and test same in un-clustered search head environment, below are steps for same:-
1) Login to search head UI and drag drop the apps in the order we want.
2) Copy the settings for appOrder from [general] stanza which got created under
3) Create below file with copied stanza with specified setting
This file will override all the appOrders created for any user in any user-prefs.conf.
4) restart the splunk search head to see the changes.
For clustered search heads we need to do it manually on all search heads inside system/local folder because if we create an app and push it from DS then user setting will take precedence.
Thanks for all the inputs provided.