- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I would like to restart the web and indexer services. I want to contact all Splunk users and post something on the splunk web logon screen that there will be degraded services during this time.
I edited the web.conf file to display the notice but is there a way to see all the users logged into splunk and send them a message at the start of the process?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I used both methods and one more.
I edited the web.conf to have a banner that told incoming users that there would be degraded services.
I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"
I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice
Thanks to wolverine and somesoni for the help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I used both methods and one more.
I edited the web.conf to have a banner that told incoming users that there would be degraded services.
I sent out a message to all UI users, logged into spunk using the suggestion from "the_wolverine"
I did a search for the logged in users from the lat 24 hours using the search from "somesoni2" and sent out an email notice
Thanks to wolverine and somesoni for the help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can set a banner message that any user logged in to UI will see:
http://answers.splunk.com/answers/68766/how-can-i-set-a-custom-splunk-bannerwarning
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
never mind
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

This shows up at the top of the UI as a yellow banner. I think as soon as they clicked to another view or ran a search, they would see it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What about users that are already logged in?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Below is the search which will give you currently logged in users.
| rest /services/authentication/httpauth-tokens | search (NOT userName=\"splunk-system-user\") searchId=\"\"
| table userName splunk_server timeAccessed
I am not aware if we can send message to individual users, but I would be interested to see how it can be done.
