Reporting
Highlighted

Is there a way to retrieve the messages from the banner at the top of the UI and email me a report on them?

Splunk Employee
Splunk Employee

I wanted to have a check of the messages displayed on the top of the UI and email me a report on them, instead of logging in to see them.

Tags (4)
Highlighted

Re: Is there a way to retrieve the messages from the banner at the top of the UI and email me a report on them?

Splunk Employee
Splunk Employee

And I found this search to get them :

| rest /services/messages | table title message severity timeCreated_iso published splunk_server author 

Then schedule it with an alert to email me a copy once a while.


PS : If you want to create messages for your users on the fly from the command line

curl -k -u admin:changeme https://localhost:8089/services/messages -d severity="warn" -d name=message -d value="This is your Splunk Admin, there will be a maintenance of this instance in 10 minutes -> 15:00 , ETA of 30 minutes -> 15:30, for updates contact me at YourFriendlyNeighborhoodAdmin@mydomain.com"

View solution in original post

Highlighted

Re: Is there a way to retrieve the messages from the banner at the top of the UI and email me a report on them?

SplunkTrust
SplunkTrust

For completeness' sake, you can also add messages through the UI by going to Settings -> User Interface -> Bulletin Messages.