Splunk Search

How to have Splunk URL parameters to redirect url to splunk App?



We have an application the allows users to click on a link taking them to splunk.

The problem is that the link is hard coded in the application and only allows users to go to:


In our environment we have set the default search app as not visible and the users default app is set to one we created.


Does anyone know if there are any query string parameters I can append to the default app url that would redirect to my preferred app? (this option is available in the external app we are using)

Labels (1)
0 Karma


Basically: No, Splunk does not have such parameters. You will have to either change the coding in the calling App, or implement some sort of redirection method - maybe using a proxy listening on the Splunk Web Port, and rewriting calls to the standard app path.

0 Karma

Loves-to-Learn Everything


I did it you can use the return_to URL parameter.

Here's an ex: URL..




When the user clicks on this URL, they will first be taken to the search app, and then they will be redirected to your preferred app MYAPP/search.

Manually test the redirection, Use browser developer tools to inspect network requests and redirects or use any online tool like https://redirectchecker.com/  This can help you to get detail redirection report might help pinpoint the issue.let me know still you have issue.

Ref: doc

0 Karma


You can setup a default_namespace = under user-prefs.conf to login to users preferred app...

default_namespace = <app name>
* Specifies the app that the user will see initially upon login to the
  Splunk Web User Interface.
* This uses the "short name" of the app, such as launcher, or search,
  which is synonymous with the app directory name.
* Splunk defaults this to 'launcher' via the default authorize.conf


0 Karma


Hi prakash007 thanks for reply, I however do have the default namespace set, after login it redirects to the correct app however. once you are logged in if you go to https://HOSTNAME:8000/en-GB/app/search/search you are not redirect to the default namespace app. instead you get an error, because I have the app set as invisible.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...