Security

How do I notify all logged on splunk users about restarts?

hartfoml
Motivator

I would like to restart the web and indexer services. I want to contact all Splunk users and post something on the splunk web logon screen that there will be degraded services during this time.

I edited the web.conf file to display the notice but is there a way to see all the users logged into splunk and send them a message at the start of the process?

Tags (2)
1 Solution

hartfoml
Motivator

I used both methods and one more.

I edited the web.conf to have a banner that told incoming users that there would be degraded services.

I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"

I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice

Thanks to wolverine and somesoni for the help.

View solution in original post

hartfoml
Motivator

I used both methods and one more.

I edited the web.conf to have a banner that told incoming users that there would be degraded services.

I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"

I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice

Thanks to wolverine and somesoni for the help.

View solution in original post

the_wolverine
Champion

You can set a banner message that any user logged in to UI will see:
http://answers.splunk.com/answers/68766/how-can-i-set-a-custom-splunk-bannerwarning

lukejadamec
Super Champion

never mind

0 Karma

the_wolverine
Champion

This shows up at the top of the UI as a yellow banner. I think as soon as they clicked to another view or ran a search, they would see it.

lukejadamec
Super Champion

What about users that are already logged in?

0 Karma

somesoni2
Revered Legend

Below is the search which will give you currently logged in users.
| rest /services/authentication/httpauth-tokens | search (NOT userName=\"splunk-system-user\") searchId=\"\"
| table userName splunk_server timeAccessed

I am not aware if we can send message to individual users, but I would be interested to see how it can be done.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!