Security

How do I notify all logged on splunk users about restarts?

hartfoml
Motivator

I would like to restart the web and indexer services. I want to contact all Splunk users and post something on the splunk web logon screen that there will be degraded services during this time.

I edited the web.conf file to display the notice but is there a way to see all the users logged into splunk and send them a message at the start of the process?

Tags (2)
1 Solution

hartfoml
Motivator

I used both methods and one more.

I edited the web.conf to have a banner that told incoming users that there would be degraded services.

I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"

I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice

Thanks to wolverine and somesoni for the help.

View solution in original post

hartfoml
Motivator

I used both methods and one more.

I edited the web.conf to have a banner that told incoming users that there would be degraded services.

I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"

I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice

Thanks to wolverine and somesoni for the help.

the_wolverine
Champion

You can set a banner message that any user logged in to UI will see:
http://answers.splunk.com/answers/68766/how-can-i-set-a-custom-splunk-bannerwarning

lukejadamec
Super Champion

never mind

0 Karma

the_wolverine
Champion

This shows up at the top of the UI as a yellow banner. I think as soon as they clicked to another view or ran a search, they would see it.

lukejadamec
Super Champion

What about users that are already logged in?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Below is the search which will give you currently logged in users.
| rest /services/authentication/httpauth-tokens | search (NOT userName=\"splunk-system-user\") searchId=\"\"
| table userName splunk_server timeAccessed

I am not aware if we can send message to individual users, but I would be interested to see how it can be done.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...