Users are constantly being prompted to "take the tour" when logging into Splunk 6.4.1

[mikelanghorst]

After I upgraded my Splunk environment to 6.4.1, my users are reporting that they are repeatedly prompted as a new user would to take the tour for the app. I notice for users that are not getting it, under etc/users/username/app/local/ui-tour.conf will have a viewed = 1, while other users do not.

Any idea why this is occurring?

[teunlaan · Accepted solution]

We noticed when there is an new app with tour (ITSI), it wil allways pop-up the tour as long there is nothing configured in the new app.

So are the users "working" with app or just open it?

The is also a global setting to Ignore the tours.
Place ui-tour.conf in etc/system/local with

[default]
useTour = false

[jkat54]

Sounds like a permissions issue on the filesystem. Check that the owner of the Splunk process has write permission on that users folder.