Some users inheriting default app from "system" when they are part of roles for setting the default app

[ejwade]

I've been creating roles specifically for setting the default app for users in that role. I have also cleared the default app for all standard Splunk roles (admin, power, user).

For whatever reason, some of my users are inheriting the default app from "system", while others inherit from the roles created to apply a default app. These users are part of the same roles. Is there a user setting somewhere that specifies inheritance or default app setting? It would be nice to know the conf file too for where a user defined default app is set.

[woodcock · Accepted solution]

When a user picks his own app, it is stored as default_namespace in the [general] stanza here:

$SPLUNK_HOME/etc/users/<Some User ID Here>/user-prefs/local/user-prefs.conf

[ejwade]

This was it! Thank you, @woodcock!

[woodcock]

Users may override your setting with their own personal-level settings and there is nothing that you can do about that.

[ejwade]

I downvoted this post because not helpful - not technical.

[ejwade]

@woodcock, totally agree. I'm trying to clear the user's selection - specifically my own. In Splunk Web, there's no option to deselect the default app, and inherit from roles. Once you select a custom default app, I can't find how to clear that selection. It would also be useful to know what config file would have this custom setting as well.