Splunk Enterprise

View deleted messages in splunk bar

Shihua
Engager

I would want to know how to view those deleted messages from the splunk bar?  Example, if i accidentally deleted a messages from the splunk bar, how can i view those messages again either from the web ui or cli.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

Those message stanzas are configured on messages.conf, but at least I cannot find any option, which allow reshowing those regularly after you have deleted those.

Some of those messages can found from _internal, but yo must know what you are looking for.

Some messages pop up again e.g. after you log in again and splunk has done some checks which rise those, but this is not valid for all.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

Those message stanzas are configured on messages.conf, but at least I cannot find any option, which allow reshowing those regularly after you have deleted those.

Some of those messages can found from _internal, but yo must know what you are looking for.

Some messages pop up again e.g. after you log in again and splunk has done some checks which rise those, but this is not valid for all.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Harnessing Splunk’s Federated Search for Amazon S3

Managing your data effectively often means balancing performance, costs, and compliance. Splunk’s Federated ...

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...