How can I remove alerts in the messages tab in Splunk Web via curl?

[a385369]

How can I remove alerts in the messages tab in Splunk Web via curl?
Users are reading them and panicking far to often.

[kamlesh_vaghela · Accepted solution]

@a385369 

If they are important messages then we should address them.

Well, there are no simple curl ways to delete all messages but you can delete it individually. using below curl command.

curl -k -u admin:pass --request DELETE https://localhost:8089/services/messages/sampleMessage

Here,

`sampleMessage` is message name. an identifier of single message.

So, using curl you have to execute curl command for each message.

To get all the messages you can use below curl,

curl -k -u admin:admin123 https://localhost:8089/services/messages?output_mode=json

you will find the entry array with all the messages with name property. just use it and delete the message.

You can achieve this by using below python script. This is my POC script.

You can use it by updating it as per your requirement.

import requests, json, base64
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

usrPass = b"admin:admin123"
b64Val = base64.b64encode(usrPass).decode('utf-8')

url = "https://localhost:8089/services/messages?output_mode=json"

payload={}
headers = {
  'Authorization': f'Basic {str(b64Val)}'
}

response = requests.request("GET", url, headers=headers, data=payload, verify=False)
data = json.loads(response.text)

for message in data['entry']:
    print(message['name'])
    delete_url = f"https://localhost:8089/services/messages/{message['name']}"
    response = requests.request("DELETE", delete_url, headers=headers, data=payload, verify=False)
    print(response.text)

I hope this will help you.

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[a385369]

Thanks very much for the clues.   Yes, messages can be useful, but not when every user in the company reads them and might decide to open a trouble ticket for them.

I tend to use Korn shell on our systems and here's the section where I flushed all of the messages and replaced them with a new one  (user input when the script begins.).

echo -e "Collecting existing messages on $SH... "
curl -k -u $uid:$pw https://$SH:8089/services/messages?output_mode=xml > /tmp/msg.out
echo -e "Beginning cleanup of messages... "
for MESSAGE in `egrep '<title>' /tmp/msg.out|grep -v messages|cut -d">" -f2|cut -d"<" -f1`
do
     echo -e " Cleanup of $MESSAGE..."
     curl -k -u $uid:$pw -X "DELETE" https://$SH:8089/services/messages/$MESSAGE >/dev/null 2>&1
done
echo -e " Now, sending your message to $SH "
curl -k -u $uid:$pw https://$SH:8089/services/messages -d severity="$SEV" -d name=Custom_Message -d value="$msg" >/dev/null 2>&1