topic Re: How do I notify all logged on splunk users about restarts? in Security

How do I notify all logged on splunk users about restarts?

hartfoml — Tue, 03 Dec 2013 18:41:24 GMT

I would like to restart the web and indexer services. I want to contact all Splunk users and post something on the splunk web logon screen that there will be degraded services during this time.

I edited the web.conf file to display the notice but is there a way to see all the users logged into splunk and send them a message at the start of the process?

Re: How do I notify all logged on splunk users about restarts?

somesoni2 — Tue, 03 Dec 2013 19:28:27 GMT

Below is the search which will give you currently logged in users.
| rest /services/authentication/httpauth-tokens | search (NOT userName=\"splunk-system-user\") searchId=\"\"
| table userName splunk_server timeAccessed

I am not aware if we can send message to individual users, but I would be interested to see how it can be done.

Re: How do I notify all logged on splunk users about restarts?

the_wolverine — Tue, 03 Dec 2013 21:05:31 GMT

You can set a banner message that any user logged in to UI will see:
http://answers.splunk.com/answers/68766/how-can-i-set-a-custom-splunk-bannerwarning

Re: How do I notify all logged on splunk users about restarts?

lukejadamec — Wed, 04 Dec 2013 00:04:51 GMT

What about users that are already logged in?

Re: How do I notify all logged on splunk users about restarts?

the_wolverine — Wed, 04 Dec 2013 00:28:26 GMT

This shows up at the top of the UI as a yellow banner. I think as soon as they clicked to another view or ran a search, they would see it.

Re: How do I notify all logged on splunk users about restarts?

lukejadamec — Wed, 04 Dec 2013 00:39:18 GMT

never mind

Re: How do I notify all logged on splunk users about restarts?

hartfoml — Thu, 05 Dec 2013 17:45:20 GMT

I used both methods and one more.

I edited the web.conf to have a banner that told incoming users that there would be degraded services.

I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"

I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice

Thanks to wolverine and somesoni for the help.