In my Users page: https://splunk:8000/en-US/manager/search/authentication/users, all of our LDAP users accounts show "[PROCESSING ERROR]" in the column: Default app inherited from.
Is there a command to bulk-reassign each/all user's default app, or otherwise clear up this apparent error message?
I found an error in my splunkd.log = "AuthorizationManager - Capability 'edit_per_panel_filters' is not recognized by Splunk. Ignoring.."
Removed some of the suspect stanzas from authorize.conf - matching them up with authentication.conf, restarted and the error disappeared from the column. Also, the install apps buttons returned along with columns to disable/enable apps.