View deleted messages in splunk bar

[Shihua]

I would want to know how to view those deleted messages from the splunk bar?  Example, if i accidentally deleted a messages from the splunk bar, how can i view those messages again either from the web ui or cli.

[isoutamo · Accepted solution]

Hi

Those message stanzas are configured on messages.conf, but at least I cannot find any option, which allow reshowing those regularly after you have deleted those.

Some of those messages can found from _internal, but yo must know what you are looking for.

Some messages pop up again e.g. after you log in again and splunk has done some checks which rise those, but this is not valid for all.

r. Ismo