stop all users seeing a license warning message

[chrispolk]

Is there a way to stop all our users from seeing the license warning messages and have only our admins see this?

Obviously the fix is to not exceed the license, but periodically we run over with new sources coming online. I dont want our less technical dashboard focussed users seeing these license warning messages. Really these messages are only relevant for our admins who can actually do something about it.

[gooza]

What about filtering the messages in the relevant apps with application.js as suggested in:

http://splunk-base.splunk.com/answers/3123/message-module-filter-values

[chris_lewis]

Is there any progress on this? I see errors like this at one of my sites on the search head consistently:

The running job "1366883794.12593.hostname" was canceled remotely or expired.

I would like to be able to disable the warning as multiple warnings pop up at once. Any advice on what may be causing this would also help?

[ryancammer_kaba]

use adblock and just block the element. there's some warning on my splunk instance about some pool warning, for a splunk instance that we haven't hardly used, with some warning about a pool violation, which makes no sense. i just applied the following adblock filter:

LI[class="message warn"]

and if splunk stops working, we'll just uninstall it and use nurelic instead, since we're indexing so little data.

[RicoSuave · Accepted solution]

Hello Chris,
Unfortunately there is no way to control which users see these messages. Enhancement request 2431 has been filed to address this very issue. There is no ETA on when this will be implemented. There is one workaround. It involves removing the message module from the views your users access.

[mikelanghorst]

Would be nice to be able to "acknowledge" the message so you don't constantly have it up all day.

[RicoSuave]

Yes, that is real answer. Or you can buy a bigger license 😉

[chrispolk]

Thank you.

Ultimately we need to get better at managing the volumes.