Security
Highlighted

Set Default App by Role?

Champion

Hello,
Is there a way to set default app based on role? I know I can set default app through user-prefs.conf or through the GUI per user; however, this seems a little tedious if users are being mapped through LDAP or scripted authentication.

Thanks in advance.

Tags (3)
Highlighted

Re: Set Default App by Role?

Splunk Employee
Splunk Employee

it's in defined in the role as "default app" in manager > access controls > Roles > ....
And can be overwritten by the users in their own user preferences.
I do not know who win in case of roles inheritance, or users members of multiple roles.

View solution in original post

Highlighted

Re: Set Default App by Role?

Champion

Do which conf file I would edit in stead of using the Web UI? I prefer to do all management through conf files with an large env. Thanks

0 Karma
Highlighted

Re: Set Default App by Role?

Splunk Employee
Splunk Employee

authorize.conf, usually in $SPLUNK_HOME/etc/system/local

0 Karma
Highlighted

Re: Set Default App by Role?

SplunkTrust
SplunkTrust

Actually, although most things on that page are set in authorize.conf, the "default app" setting ends up in user-prefs.conf, written to etc/apps//local/user-prefs.conf

as

[roleuser]
default
namespace =

Highlighted

Re: Set Default App by Role?

Splunk Employee
Splunk Employee

don't you mean

[roleuser]
default
namespace = app_name

0 Karma
Highlighted

Re: Set Default App by Role?

SplunkTrust
SplunkTrust

Ugh. Yes, thanks. Splunkbase mangled my comment. I guess if you use corner brackets in a comment it thinks you're trying to write xml.

0 Karma
Highlighted

Re: Set Default App by Role?

Splunk Employee
Splunk Employee
0 Karma
Highlighted

Re: Set Default App by Role?

Contributor

Today I had to deal with this issue, and I found out that the path in the hosts of our cluster is

etc/apps/user-prefs/local/user-prefs.conf

We have version 6.2.5

0 Karma
Highlighted

Re: Set Default App by Role?

Builder

Try this:
In user-prefs.conf file write this:
default_namespace =

Like to admin give default app as search
$SPLUNKHOME/etc/users/admin/user-prefs/local/user-prefs.conf
default
namespace = search

-Kamal Bisht

0 Karma