Customize Splunk Web messages

You can modify notifications that display in Splunk Web in one of two ways:

• You can add and edit the text of custom notifications that display in the Messages menu.
• You can set the audience for certain error or warning messages generated by Splunk Enterprise.

Add or edit a custom notification

Add or edit a custom notification in Splunk Web or using the Splunk platform REST API.

Add a custom notification in Splunk Web

You can add a custom message to Splunk Web, for example to notify your users of scheduled maintenance. You need admin or system user level privileges to add or edit a custom notification.

To add or change a custom notification:

1. Select Settings > User Interface.
2. Click New to create a new message, or click Bulletin Messages and select the message you want to edit.
3. Give your new message a name and message text, or edit the existing text.
4. Click Save. The message will now appear when the user accesses Messages in the menu.

Add a custom notification using the Splunk platform REST API

For information on how to add a custom notification using the Splunk platform REST API, see Message users in apps for Splunk Cloud Platform and Splunk Enterprise in the Splunk Developer Guide.

Set audience for a Splunk Enterprise message

For some messages that appear in Splunk Web, you can control which users see the message.

If by default a message displays only for users with a particular capability, such as admin_all_objects, you can display the message to more of your users, without granting them the admin_all_objects capability. Or you can have fewer users see a message.

The message you configure must exist in messages.conf. You can set the audience for a message by role or by capability, by modifying settings in messages.conf.

Identify a message available for audience scoping

The message you restrict must exist in messages.conf. Not all messages reside in messages.conf. If a message contains a Learn more link it resides in messages.conf and is configurable. If a message does not contain a Learn more link, it might or might not reside in messages.conf and be configurable.

For example, the message in the following image contains a Learn more link:

Once you have chosen a message that you want to configure, check whether it is configurable. Search for parts of the message string in $SPLUNK_HOME/etc/system/default/messages.conf on *nix or %SPLUNK_HOME%\etc\system\default\messages.conf on Windows. The message string is a setting within a stanza. The stanza name is a message identifier. Make note of the stanza name to use in your customized copy of messages.conf. Never edit the configuration files that are in the default directory.

For example, searching the default messages.conf for text from the sample message shown above, such as "artifacts," leads you to the following stanza:

[DISPATCHCOMM:TOO_MANY_JOB_DIRS__LU_LU]
message      = The number of search artifacts in the dispatch directory is higher than recommended (count=%lu, warning threshold=%lu) and could have an impact on search performance.
action       = Remove excess search artifacts using the "splunk clean-dispatch" CLI command, and review artifact retention policies in limits.conf and savedsearches.conf. You can also raise this warning threshold in limits.conf / dispatch_dir_warning_size.
severity     = warn
capabilities = admin_all_objects
help         = message.dispatch.artifacts 

The stanza name for this message is DISPATCHCOMM:TOO_MANY_JOB_DIRS__LU_LU.

Scope a message by capability

Set the capabilities required to view a message by editing the capabilities attribute in the messages.conf stanza for the message. A user must have all the listed capabilities to view the message.

For example,

[DISPATCHCOMM:TOO_MANY_JOB_DIRS__LU_LU]
capabilities = admin_all_objects, can_delete

For a list of capabilities and their definitions, see About defining roles with capabilities in Securing Splunk Enterprise.

If a role attribute is set for the message, that attribute takes precedence over the capabilities attribute. The capabilities attribute for the message is ignored.

See messages.conf.spec.

Scope a message by role

Set the roles required to view a message by editing the roles attribute in the messages.conf stanza for the message. If a user belongs to any of these roles, the message is visible to them.

If a role attribute is set for the message, that attribute takes precedence over the capabilities attribute. The capabilities attribute for the message is ignored.

For example:

[DISPATCHCOMM:TOO_MANY_JOB_DIRS__LU_LU]
roles = admin

See About configuring role-based user access in Securing Splunk Enterprise.