Set Default App by Role?

[bmacias84]

Hello,
Is there a way to set default app based on role? I know I can set default app through user-prefs.conf or through the GUI per user; however, this seems a little tedious if users are being mapped through LDAP or scripted authentication.

Thanks in advance.

[kml_uvce]

Try this:
In user-prefs.conf file write this:
default_namespace =

Like to admin give default app as search
$SPLUNK_HOME/etc/users/admin/user-prefs/local/user-prefs.conf
default_namespace = search

-Kamal Bisht

[yannK · Accepted solution]

it's in defined in the role as "default app" in manager > access controls > Roles > ....
And can be overwritten by the users in their own user preferences.
I do not know who win in case of roles inheritance, or users members of multiple roles.

[sansay]

Today I had to deal with this issue, and I found out that the path in the hosts of our cluster is

etc/apps/user-prefs/local/user-prefs.conf

We have version 6.2.5

[yannK]

yes, see http://docs.splunk.com/Documentation/Splunk/5.0.4/Admin/Whatsanapp

[sideview]

Ugh. Yes, thanks. Splunkbase mangled my comment. I guess if you use corner brackets in a comment it thinks you're trying to write xml.

[jrodman]

don't you mean

[role_user]
default_namespace = app_name

[sideview]

Actually, although most things on that page are set in authorize.conf, the "default app" setting ends up in user-prefs.conf, written to etc/apps//local/user-prefs.conf

as

[role_user]
default_namespace =

[yannK]

authorize.conf, usually in $SPLUNK_HOME/etc/system/local

[bmacias84]

Do which conf file I would edit in stead of using the Web UI? I prefer to do all management through conf files with an large env. Thanks