When ever I create a new user I'd like to have some default rules in there search/local/ui-prefs.conf file. Is there a template which is copied for new users?
You can create this file in $SPLUNK_HOME/etc/system/local
if you want to force defaults for all users. Individuals accounts can, of course, have different options, as well.
I would setup Active Directory or LDAP authentication:
http://docs.splunk.com/Documentation/Splunk/6.0/Security/SetupuserauthenticationwithLDAP
Then I would create all the groups in AD and create roles in Splunk. Then you can easily manage the default user behavior in the Splunk roles.
I would then create an app and put that as their default app as well. Finally, you don't just have to put the ui-prefs.conf in system/local
, you can put it in each [appname]/default
or [appname]/local
.
You can create this file in $SPLUNK_HOME/etc/system/local
if you want to force defaults for all users. Individuals accounts can, of course, have different options, as well.