Security

Set Default App by Role?

bmacias84
Champion

Hello,
Is there a way to set default app based on role? I know I can set default app through user-prefs.conf or through the GUI per user; however, this seems a little tedious if users are being mapped through LDAP or scripted authentication.

Thanks in advance.

Tags (3)
1 Solution

yannK
Splunk Employee
Splunk Employee

it's in defined in the role as "default app" in manager > access controls > Roles > ....
And can be overwritten by the users in their own user preferences.
I do not know who win in case of roles inheritance, or users members of multiple roles.

View solution in original post

kml_uvce
Builder

Try this:
In user-prefs.conf file write this:
default_namespace =

Like to admin give default app as search
$SPLUNK_HOME/etc/users/admin/user-prefs/local/user-prefs.conf
default_namespace = search

-Kamal Bisht

0 Karma

yannK
Splunk Employee
Splunk Employee

it's in defined in the role as "default app" in manager > access controls > Roles > ....
And can be overwritten by the users in their own user preferences.
I do not know who win in case of roles inheritance, or users members of multiple roles.

sansay
Contributor

Today I had to deal with this issue, and I found out that the path in the hosts of our cluster is

etc/apps/user-prefs/local/user-prefs.conf

We have version 6.2.5

0 Karma

yannK
Splunk Employee
Splunk Employee
0 Karma

sideview
SplunkTrust
SplunkTrust

Ugh. Yes, thanks. Splunkbase mangled my comment. I guess if you use corner brackets in a comment it thinks you're trying to write xml.

0 Karma

jrodman
Splunk Employee
Splunk Employee

don't you mean

[role_user]
default_namespace = app_name

0 Karma

sideview
SplunkTrust
SplunkTrust

Actually, although most things on that page are set in authorize.conf, the "default app" setting ends up in user-prefs.conf, written to etc/apps//local/user-prefs.conf

as

[role_user]
default_namespace =

yannK
Splunk Employee
Splunk Employee

authorize.conf, usually in $SPLUNK_HOME/etc/system/local

0 Karma

bmacias84
Champion

Do which conf file I would edit in stead of using the Web UI? I prefer to do all management through conf files with an large env. Thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...