How do I notify all logged on splunk users about restarts?

[hartfoml]

I would like to restart the web and indexer services. I want to contact all Splunk users and post something on the splunk web logon screen that there will be degraded services during this time.

I edited the web.conf file to display the notice but is there a way to see all the users logged into splunk and send them a message at the start of the process?

[hartfoml · Accepted solution]

I used both methods and one more.

I edited the web.conf to have a banner that told incoming users that there would be degraded services.

I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"

I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice

Thanks to wolverine and somesoni for the help.

[the_wolverine]

You can set a banner message that any user logged in to UI will see:
http://answers.splunk.com/answers/68766/how-can-i-set-a-custom-splunk-bannerwarning

[lukejadamec]

never mind

[the_wolverine]

This shows up at the top of the UI as a yellow banner. I think as soon as they clicked to another view or ran a search, they would see it.

[lukejadamec]

What about users that are already logged in?

[somesoni2]

Below is the search which will give you currently logged in users.
| rest /services/authentication/httpauth-tokens | search (NOT userName=\"splunk-system-user\") searchId=\"\"
| table userName splunk_server timeAccessed

I am not aware if we can send message to individual users, but I would be interested to see how it can be done.