I would like to restart the web and indexer services. I want to contact all Splunk users and post something on the splunk web logon screen that there will be degraded services during this time.
I edited the web.conf file to display the notice but is there a way to see all the users logged into splunk and send them a message at the start of the process?
I used both methods and one more.
I edited the web.conf to have a banner that told incoming users that there would be degraded services.
I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"
I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice
Thanks to wolverine and somesoni for the help.
I used both methods and one more.
I edited the web.conf to have a banner that told incoming users that there would be degraded services.
I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"
I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice
Thanks to wolverine and somesoni for the help.
You can set a banner message that any user logged in to UI will see:
http://answers.splunk.com/answers/68766/how-can-i-set-a-custom-splunk-bannerwarning
never mind
This shows up at the top of the UI as a yellow banner. I think as soon as they clicked to another view or ran a search, they would see it.
What about users that are already logged in?
Below is the search which will give you currently logged in users.
| rest /services/authentication/httpauth-tokens | search (NOT userName=\"splunk-system-user\") searchId=\"\"
| table userName splunk_server timeAccessed
I am not aware if we can send message to individual users, but I would be interested to see how it can be done.