This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6
You can set a default App, either per user or globally. This App displays by default every time you log into Splunk.
1. Create a file called user-prefs.conf in the user's local directory (to apply to a user):
$SPLUNK_HOME/etc/users/<user>/user-prefs/local/user-prefs.conf
Or in the user-prefs App directory (to apply globally):
$SPLUNK_HOME/etc/apps/user-prefs/local/user-prefs.conf
2. Add the following to the user-prefs.conf file:
default_namespace = <App>
Note: The App name is case-sensitive.
3. Restart Splunk to load your new configuration.
For example, set the default App for the admin user to the Search App:
1. Edit $SPLUNK_HOME/etc/users/admin/user-prefs/local/user-prefs.conf. For the test user, it would be in $SPLUNK_HOME/etc/users/test/user-prefs/local/user-prefs.conf
2. Add the following:
default_namespace = search