Security

Set Default App by Role?

bmacias84
Champion

Hello,
Is there a way to set default app based on role? I know I can set default app through user-prefs.conf or through the GUI per user; however, this seems a little tedious if users are being mapped through LDAP or scripted authentication.

Thanks in advance.

Tags (3)
1 Solution

yannK
Splunk Employee
Splunk Employee

it's in defined in the role as "default app" in manager > access controls > Roles > ....
And can be overwritten by the users in their own user preferences.
I do not know who win in case of roles inheritance, or users members of multiple roles.

View solution in original post

kml_uvce
Builder

Try this:
In user-prefs.conf file write this:
default_namespace =

Like to admin give default app as search
$SPLUNK_HOME/etc/users/admin/user-prefs/local/user-prefs.conf
default_namespace = search

-Kamal Bisht

0 Karma

yannK
Splunk Employee
Splunk Employee

it's in defined in the role as "default app" in manager > access controls > Roles > ....
And can be overwritten by the users in their own user preferences.
I do not know who win in case of roles inheritance, or users members of multiple roles.

sansay
Contributor

Today I had to deal with this issue, and I found out that the path in the hosts of our cluster is

etc/apps/user-prefs/local/user-prefs.conf

We have version 6.2.5

0 Karma

yannK
Splunk Employee
Splunk Employee
0 Karma

sideview
SplunkTrust
SplunkTrust

Ugh. Yes, thanks. Splunkbase mangled my comment. I guess if you use corner brackets in a comment it thinks you're trying to write xml.

0 Karma

jrodman
Splunk Employee
Splunk Employee

don't you mean

[role_user]
default_namespace = app_name

0 Karma

sideview
SplunkTrust
SplunkTrust

Actually, although most things on that page are set in authorize.conf, the "default app" setting ends up in user-prefs.conf, written to etc/apps//local/user-prefs.conf

as

[role_user]
default_namespace =

yannK
Splunk Employee
Splunk Employee

authorize.conf, usually in $SPLUNK_HOME/etc/system/local

0 Karma

bmacias84
Champion

Do which conf file I would edit in stead of using the Web UI? I prefer to do all management through conf files with an large env. Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...