https://community.splunk.com/t5/Splunk-Dev/Blue-bar-warnings/m-p/24379#M265 <P>The importance of messages are hardcoded, so the decision is made by the developer.</P> <P>There is no list of all error messages you could use to build a lookup, so you may want to start with a simple count <BR /> ERROR / WARN / FATAL events per component.</P> <PRE><CODE> index=_internal source=*splunkd.log* NOT log_level=INFO NOT log_level=DEBUG | chart count by component log_level </CODE></PRE> <P>or check the dashboards on the SOS app.</P> Thu, 14 May 2015 17:31:22 GMT yannK 2015-05-14T17:31:22Z https://community.splunk.com/t5/Splunk-Dev/Blue-bar-warnings/m-p/24378#M264 <P>How does Splunk decide on which splunkd WARNs are important enough to be displayed in the blue warning bar and which are filtered out? </P> <P>For example the following message will get displayed:</P> <PRE><CODE>01-11-2011 12:16:51.012 WARN databasePartitionPolicy - applying indexing throttle for &lt;indexPath&gt; because bucket has too many tsidx files, is your splunk-optimize working? </CODE></PRE> <P>but this one won't: </P> <PRE><CODE>01-11-2011 13:45:41.474 WARN databasePartitionPolicy - Handling shutdown or signal in DatabasePartitionPolicy: &lt;indexPath&gt; </CODE></PRE> <P>There should be some kind of a default list of filters...</P> <P>Rational - I want to create a scheduled search that will email the "important" warnings to splunk admin. </P> Tue, 11 Jan 2011 20:20:53 GMT https://community.splunk.com/t5/Splunk-Dev/Blue-bar-warnings/m-p/24378#M264 IgorB 2011-01-11T20:20:53Z https://community.splunk.com/t5/Splunk-Dev/Blue-bar-warnings/m-p/24379#M265 <P>The importance of messages are hardcoded, so the decision is made by the developer.</P> <P>There is no list of all error messages you could use to build a lookup, so you may want to start with a simple count <BR /> ERROR / WARN / FATAL events per component.</P> <PRE><CODE> index=_internal source=*splunkd.log* NOT log_level=INFO NOT log_level=DEBUG | chart count by component log_level </CODE></PRE> <P>or check the dashboards on the SOS app.</P> Thu, 14 May 2015 17:31:22 GMT https://community.splunk.com/t5/Splunk-Dev/Blue-bar-warnings/m-p/24379#M265 yannK 2015-05-14T17:31:22Z