Splunk Search

What is the proper way to make user-prefs settings take effect?

twinspop
Influencer

I am trying to to default particular roles to particular apps by including default_namespace in a user-prefs file inside the target app. This doesn't work.

How do you customize user-prefs and have it take effect?

0 Karma
1 Solution

twinspop
Influencer

According to user-prefs.conf.spec:

It also means that values in another app will never be used unless they are
exported globally (to system scope) or to the user-prefs app

So you need to create the meta file entry to export this setting to system. In appname/metadata/default.meta include this:

[user-prefs/role_myrole]
export = system

Your entry in user-prefs.conf:

[role_myrole]
default_namespace = appname

Will now behave as expected.

View solution in original post

twinspop
Influencer

According to user-prefs.conf.spec:

It also means that values in another app will never be used unless they are
exported globally (to system scope) or to the user-prefs app

So you need to create the meta file entry to export this setting to system. In appname/metadata/default.meta include this:

[user-prefs/role_myrole]
export = system

Your entry in user-prefs.conf:

[role_myrole]
default_namespace = appname

Will now behave as expected.

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...