Splunk Search

How to search for all banner messages?

richnavis
Contributor

As part of understanding our end user experience, I'd like to create a search that tells me whenever splunk created a message that appeared as a banner message to end users. Is this possible?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

One place to start would be this:

index=_internal source="*web_service.log" raise

You'll get events for exceptions being raised, usually that's equivalent to a red error message. Off the top of my instance I don't see blue info messages being logged though.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

One place to start would be this:

index=_internal source="*web_service.log" raise

You'll get events for exceptions being raised, usually that's equivalent to a red error message. Off the top of my instance I don't see blue info messages being logged though.

w531t4
Path Finder

Is there a definitive way to do this? Including "usually" as part of the answer isn't good enough.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...