Does anyone have any idea why my system account can't create a new bulletin / banner message?
I don't see the ability to "Add new" for Bulletin / Banner Messages (manager/search/data/messages). I don't see which capability defines this in http://docs.splunk.com/Documentation/Splunk/5.0.2/admin/authorizeconf.
(I'm running 5.0.2)
In 5.0.2, restart_splunkd also controls the ability to post Bulletin Messages.
Can anyone confirm if that is the case in all versions or just 5.0.2? If it's all versions then I'll submit a feature request to have it decoupled.
It's Manager » User interface » Bulletin Messages » Add new
and there's also this stanza in web.conf:
login_content = <content_string> * Add custom content to the login page * Supports any text including html
Ah, sorry, I misunderstood. Your question is "I have admin permissions, but I can't see this feature in Manager." I am not sure why it wouldn't display in your admin role. 😞 And you are correct about login_content, I wasn't sure which type of message you wanted to display.
Thanks ChrisG - I'm actually saying that there is no "Add new" at that location that you outlined. That's also where I expected to see it.
I believe the login_content field is for the login page, not for the banner messages - but let me know if I've assumed incorrectly.