Archive

how to inform the splunk users of a maintenance in splunk ?

mataharry
Communicator

I have to do some maintenances in splunk and want to warn the users that splunk will be down.

  • How to get the list of active users logged in ?
  • There is a message bar, can I post messages to it ?
Tags (2)
1 Solution

somesoni2
Revered Legend

This should give you currently logged in users. (have some extra parts to get roles of logged in users)

| rest /services/authentication/httpauth-tokens | search (NOT userName="splunk-system-user") searchId="" 
| table userName splunk_server timeAccessed |join type=left userName [| rest /services/authentication/users splunk_server=local 
|fields title roles realname|rename title as userName|rename realname as Name]
|rename userName as User |rename splunk_server as "Splunk Server"|rename timeAccessed as "Time Accessed"|rename roles as Role
|table User,"Splunk Server",Name,Role

To send a message to all logged in users, go to
Manager » User interface » Bulletin Messages and add a new bulletin message. Once Maintenance is done delete the message.

View solution in original post

yannK
Splunk Employee
Splunk Employee

You can post with the Rest endpoint, and an admin user.

# post maintenance message on a search-head

curl -k -u admin:changeme https://mysplunkinstance.domain.com:8089/services/messages -d severity="warn" -d name=message -d value="This is your Splunk Admin, there will be a maintenance of this instance in 10 minutes -> 15:00 , ETA of 30 minutes -> 15:30, for updates contact me at YourFriendlyNeighborhoodAdmin@mydomain.com"

To the list of the active users, check the SOS dashboard or this search over last hour.


earliest=-1h index=_internal source="*web_access.log*"
| rex "\d+\.\d+\.\d+\.\d+ - (?<user>\w+)"
| fillnull user value="missing"
| stats first(_time) AS "last_activity" by user
| convert ctime(last_activity)

mataharry
Communicator

so the curl command allows to specify the severity.

0 Karma

somesoni2
Revered Legend

This should give you currently logged in users. (have some extra parts to get roles of logged in users)

| rest /services/authentication/httpauth-tokens | search (NOT userName="splunk-system-user") searchId="" 
| table userName splunk_server timeAccessed |join type=left userName [| rest /services/authentication/users splunk_server=local 
|fields title roles realname|rename title as userName|rename realname as Name]
|rename userName as User |rename splunk_server as "Splunk Server"|rename timeAccessed as "Time Accessed"|rename roles as Role
|table User,"Splunk Server",Name,Role

To send a message to all logged in users, go to
Manager » User interface » Bulletin Messages and add a new bulletin message. Once Maintenance is done delete the message.

View solution in original post

mataharry
Communicator

nice, I never saw the manager interface.

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!