Splunk® Enterprise

Admin Manual

Configure Splunk Web to open directly to an app

You can configure Splunk Web so that it bypasses Splunk Home and instead opens in a specific app of your choosing. This is called setting a default app. While we recommend implementing a default app using roles, you can also set a default app for users or on a per-user basis. A default app set for a user will take precedence over the default app for that user's role.

Set a default app by role

You can set a default app for all users with a specific role. For example, you could send all users with the "user" role to an app you created, and direct all admin users to the Monitoring Console on login.

To bypass Splunk Home for all users of a specific role:

  1. In Splunk Web, click Settings > Roles.
  2. Click the name of the role you wish to configure.
  3. Select the 5. Resources tab.
  4. Use the Default app dropdown to select the new default app for the role.
  5. Click Save.

The change goes into effect without a restart.

Set a default app for all users

You can specify a default app for all users to land in when they log in. For example, to set the Search app as the global default:

  1. Create or edit $SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf (*nix) or %SPLUNK_HOME%\etc\apps\user-prefs\local\user-prefs.conf (Windows).
  2. Specify
    [general]
    default_namespace = search
  3. Restart Splunk Enterprise for the change to take effect.

See user-prefs.conf.spec.

Set a default app for a single user

In most cases, you should set default apps by role. But if your use case requires you to set a default app for a specific user, you can do this through Splunk Web.

To make the Search app the default landing app for a user:

  1. In Splunk Web, click Settings > Users.
  2. Click the name of the user you wish to configure.
  3. Use the Default app dropdown to select the new default app for the user.
  4. Click Save.

The change goes into effect without a restart.

About app permissions

A user will see an error if:

  • The user does not have permission to access their default app, or
  • The default app does not exist (for example, if it is typed incorrectly in user-prefs.conf).


See Manage app and add-on configurations and properties for information about managing permissions on an app.

Last modified on 24 August, 2023
Search and Reporting app   Where to get more apps and add-ons

This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.1.7, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.3.1, 9.3.2


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters