Alerting

How can I remove alerts in the messages tab in Splunk Web via curl?

a385369
Engager

How can I remove alerts in the messages tab in Splunk Web via curl?
Users are reading them and panicking far to often.

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@a385369 

If they are important messages then we should address them.

Well, there are no simple curl ways to delete all messages but you can delete it individually. using below curl command.

curl -k -u admin:pass --request DELETE https://localhost:8089/services/messages/sampleMessage

 

Here,

`sampleMessage` is message name. an identifier of single message.

So, using curl you have to execute curl command for each message.

To get all the messages you can use below curl,

curl -k -u admin:admin123 https://localhost:8089/services/messages?output_mode=json

 

you will find the entry array with all the messages with name property. just use it and delete the message.

You can achieve this by using below python script. This is my POC script.

You can use it by updating it as per your requirement.

 

import requests, json, base64
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

usrPass = b"admin:admin123"
b64Val = base64.b64encode(usrPass).decode('utf-8')

url = "https://localhost:8089/services/messages?output_mode=json"

payload={}
headers = {
  'Authorization': f'Basic {str(b64Val)}'
}

response = requests.request("GET", url, headers=headers, data=payload, verify=False)
data = json.loads(response.text)

for message in data['entry']:
    print(message['name'])
    delete_url = f"https://localhost:8089/services/messages/{message['name']}"
    response = requests.request("DELETE", delete_url, headers=headers, data=payload, verify=False)
    print(response.text)

 

I hope this will help you.

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@a385369 

If they are important messages then we should address them.

Well, there are no simple curl ways to delete all messages but you can delete it individually. using below curl command.

curl -k -u admin:pass --request DELETE https://localhost:8089/services/messages/sampleMessage

 

Here,

`sampleMessage` is message name. an identifier of single message.

So, using curl you have to execute curl command for each message.

To get all the messages you can use below curl,

curl -k -u admin:admin123 https://localhost:8089/services/messages?output_mode=json

 

you will find the entry array with all the messages with name property. just use it and delete the message.

You can achieve this by using below python script. This is my POC script.

You can use it by updating it as per your requirement.

 

import requests, json, base64
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

usrPass = b"admin:admin123"
b64Val = base64.b64encode(usrPass).decode('utf-8')

url = "https://localhost:8089/services/messages?output_mode=json"

payload={}
headers = {
  'Authorization': f'Basic {str(b64Val)}'
}

response = requests.request("GET", url, headers=headers, data=payload, verify=False)
data = json.loads(response.text)

for message in data['entry']:
    print(message['name'])
    delete_url = f"https://localhost:8089/services/messages/{message['name']}"
    response = requests.request("DELETE", delete_url, headers=headers, data=payload, verify=False)
    print(response.text)

 

I hope this will help you.

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

a385369
Engager

Thanks very much for the clues.   Yes, messages can be useful, but not when every user in the company reads them and might decide to open a trouble ticket for them.

I tend to use Korn shell on our systems and here's the section where I flushed all of the messages and replaced them with a new one  (user input when the script begins.).

echo -e "Collecting existing messages on $SH... "
curl -k -u $uid:$pw https://$SH:8089/services/messages?output_mode=xml > /tmp/msg.out
echo -e "Beginning cleanup of messages... "
for MESSAGE in `egrep '<title>' /tmp/msg.out|grep -v messages|cut -d">" -f2|cut -d"<" -f1`
do
     echo -e " Cleanup of $MESSAGE..."
     curl -k -u $uid:$pw -X "DELETE" https://$SH:8089/services/messages/$MESSAGE >/dev/null 2>&1
done
echo -e " Now, sending your message to $SH "
curl -k -u $uid:$pw https://$SH:8089/services/messages -d severity="$SEV" -d name=Custom_Message -d value="$msg" >/dev/null 2>&1

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...