A user by the name Greg belongs to an ldap group which is mapped successfully to a role and this role is mapped to a new app in user-prefs.conf. However, the user shows having launcher as his default app. How can I debug it?
Users may override the default app and this private settings store in his $SPLUNK_HOME/etc/apps/user/<someUserName>/ directory is hard to find. He may not have realized that he changed/saved this.
I'll start with btool first for user-prefs.conf with below command
$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug
Above command will display role mapping with application.
Below command will display user specific settings if user overwrote his/her default app.
$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug --user=<USERNAME> --app=user-prefs
and search for default_namespace parameter.