All Apps and Add-ons

Disabling splunk notifications for specific roles globally

ejahnke
Explorer

Hey everyone,

I'm currently trying to disable splunk notifications (the little popups under "Messages") for specific roles. Or in other words: I only want the admin role to see notifications.

I'm aware of the per stanza "roles" option in messages.conf, but I don't want to set the specific roles for every messages. Another reason why I don't want to do it per stanza is, because I don't want to check every new add-on and app for a messages.conf.

I tried

[default]
roles = admin

in system/local just because and for some reason my test user didn't get any new messages, while my admin user continued to get new ones.
But that seemed to be lucky coincidence because logs with the MessagesManager stated:

 

WARN  MessagesManager - MessagesManager: Skipping component 'default': No name field loaded

 

That was kinda expected because the [default] stanza ist not mentioned in the messages.conf documentation.

Is there a way to limit the scope on a global scale?

Best regards,

Eric

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...