All Apps and Add-ons

Disabling splunk notifications for specific roles globally

ejahnke
Explorer

Hey everyone,

I'm currently trying to disable splunk notifications (the little popups under "Messages") for specific roles. Or in other words: I only want the admin role to see notifications.

I'm aware of the per stanza "roles" option in messages.conf, but I don't want to set the specific roles for every messages. Another reason why I don't want to do it per stanza is, because I don't want to check every new add-on and app for a messages.conf.

I tried

[default]
roles = admin

in system/local just because and for some reason my test user didn't get any new messages, while my admin user continued to get new ones.
But that seemed to be lucky coincidence because logs with the MessagesManager stated:

 

WARN  MessagesManager - MessagesManager: Skipping component 'default': No name field loaded

 

That was kinda expected because the [default] stanza ist not mentioned in the messages.conf documentation.

Is there a way to limit the scope on a global scale?

Best regards,

Eric

Labels (3)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...