Display global banner

Splunk Enterprise lets you display a global banner that remains visible to all users on all UI pages across the product. The global banner feature gives organizations with strict security concerns the ability to display a site classification message that is required to run Splunk software in some environments. For example, you can display a global banner that tells users they are using a secure or classified site.

While the primary use case for the global banner is the persistent display of a site classification message, you can use it to display any type of notification that requires a persistent, highly visible message. For example, you can use the global banner to notify users about:

• New features
• Software version upgrades
• Scheduled maintenance or downtime
• Data outages

Splunk Web bulletin messages are suitable for most in-product notifications that do not require a persistent global message. For more information on bulletin messages, see Customize Splunk Web messages.

Splunk Enterprise supports the display of a single global banner only. The global banner does not appear on the Splunk Enterprise login page and users cannot dismiss the banner inside the product.

Customize the global banner

You can enable and customize the global banner using Splunk Web, REST, or configuration files.

To customize the global banner a role must have the edit_global_banner capability. This capability is provided to admin and sc_admin roles by default.

Customize global banner using Splunk Web

1. In Splunk Web, click Settings > Server Settings > Global Banner.
2. Toggle the Banner Visibility switch to On.
3. Select a background color for your global banner.
4. Enter your message text.
5. (optional) Specify a URL to generate a hyperlink to additional information, such as relevant best practices documentation.
6. Enter text for the hyperlink. For example, "Learn about best practices".
   Your customized global banner now appears on all UI pages in Splunk Enterprise.
   

Deploy global banner in a search head cluster

In a search head cluster environment, some sections of the Settings menu in Splunk Web are hidden by default. To deploy the global banner using Splunk Web in a search head cluster, you must first show the full Settings menu, as follows:

1. On any cluster member, in Splunk Web, click Settings > Show All Settings > Show.
   The full Settings menu now appears in Splunk Web.
2. Click Server settings > Global banner.
3. Customize the global banner as shown in the preceding section Customize global banner using Splunk Web.
4. Click Save.
   The search head cluster automatically replicates the global banner configuration to each cluster member and the global banner now appears in Splunk Web on each search head.

Customize global banner using REST

To customize the global banner using REST, send a POST request to the following endpoint:

data/ui/global-banner

For endpoint details, see data/ui/global-banner in the REST API Reference Manual.

Customize global banner using configuration files

You can customize the global banner by specifying settings in $SPLUNK_HOME/etc/system/local/global-banner.conf.

For detailed information on global-banner.conf settings, see global-banner.conf.