Splunk Search

What are these undocumented settings in user-prefs.conf?

matthijsk
Explorer

The documentation on user-prefs.conf is incomplete. I cannot find an explanation for the following settings:

appOrder ==> I think this manages the order the apps are shown on the
display.page.home.dashboardId ==> defines which view is shown in the launcher app as far as I can tell?
eai_app_only ==> ??
eai_results_per_page ==> ??
restart_background_jobs ==> ??
showWhatsNew ==> ??

Can somebody explain or even better update the documentation so it is complete?

Best regards

Matthijs

0 Karma

pdaigle_splunk
Splunk Employee
Splunk Employee

Here's what I could find on this:

appOrder:

A per user app order is maintained within /services/data/user-prefs endpoint, under the appOrder key
A default app order is specified in etc/apps/user-prefs/default/user-prefs.conf
By default, appOrder=search, causing the search app to appear first in the UI.

display.page.home.dashboardId:

When users first view the new home page, they will see a call-to-action for choosing their home dashboard. The id for their selected dashboard is stored in userprefs.conf as the field "display.page.home.dashboardId."

eai_app_only:

Working on this one.....not sure but it always seems to be set to False. Will update as soon as I get an answer.

eai_results_per_page:

Tells the number of results you get when you search. If you go to e.g. settings/all configurations, it will show you 100 items each page.

restart_background_jobs:

Restart background search job that has not completed when Splunk Enterprise restarts indication:
true = Restart job.
false = Do not restart job.

showWhatsNew:

A per user "showWhatsNew" flag is maintained within /services/data/user-prefs endpoint.
By default, the value is set to "1", indicating to the UI that the dialog should be displayed.
When the dialog is closed, the value is changed to 0. This will happen no matter where the user is when they close the dialog (not just on home).


I'll provide an update on the "eai_app_only" parameter once I hear back from others.

PD2

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Thanks for raising this, it is being tracked as a doc issue internally now.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...