Knowledge Management

WHY does clearing a bulletin message notification also clear the message?


When I send out a bulletin message, it stays under "Messages" and stays sent out to users until I click the X on my own message notification. I click the X on my own message notification because it's annoying, just a notification, and I was the one to send the message so I obviously don't need a notification for it, lol?

My question is. Why. It's a completely unexpected functionality for the end user; apparently none of my users have ever seen any of my messages because I assumed no developer ever would make clearing the notification for your OWN message also delete the entire message distribution?? Isn't that why you have the "Messages" interface... to, you know, manage messages?

Would very much like some clarification here.


Because these are bulletin style messages, found in a single notification location (kvstore). Per-user preferences aren't stored, possibly due to the overhead....would be up to splunk to explain the philosophy of that.

You users might not have seen the messages if they weren't scoped for the correct audience, details can be found here:

If you don't want your users to be able to delete the notifications, you can take the delete_messages capability away:

However, as stated, the way that system is built it does not record per-user preferences regarding the messages displayed.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...