topic Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker in Dashboards & Visualizations

Is there a way to remove the `Real-time` part that appears from the drop down time picker

HattrickNZ — Mon, 04 Dec 2017 02:49:30 GMT

Is there a way to remove the realtime search option from my dropdown time picker.

example of code:

  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliestTime>-24h@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="time_span">
      <label>Time Span:</label>
      <choice value="5m">5m</choice>
      <default>5m</default>
    </input>
  </fieldset>

Example of time-picker: Is there a way to remove the Real-time part that appears from the drop down time picker(highlighted in red)?

EDIT1 - This is the html code(when I do an inspect element on the dropdown) for the "Real-time" part of my pic above(The bit highlight in red). This is what I would like to remove, and as suggessted below, maybe css is the way to do it. Just not sure of the css to remove it.

   <div class="accordion-inner presets-container shared-timerangepicker-dialog-presets" data-cid="view112564" data-view="views/shared/timerangepicker/dialog/Presets" data-render-time="0.002">
    <ul class="unstyled presets-group">
        <li>Real-time</li>
        <li><a href="#" data-earliest="rt-30s" data-latest="rt">30 second window</a></li>           
        <li><a href="#" data-earliest="rt-1m" data-latest="rt">1 minute window</a></li>         
        <li><a href="#" data-earliest="rt-5m" data-latest="rt">5 minute window</a></li>         
        <li><a href="#" data-earliest="rt-30m" data-latest="rt">30 minute window</a></li>           
        <li><a href="#" data-earliest="rt-1h" data-latest="rt">1 hour window</a></li>           
        <li><a href="#" data-earliest="rt" data-latest="rt">All time (real-time)</a></li>           
    </ul>              
<div class="presets-divider-wrap">
<div class="presets-divider"></div></div>               
<ul class="unstyled presets-group">
    <li>Relative</li>
...

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

kunalmao — Tue, 29 Sep 2020 17:00:19 GMT

you can try to add a user role and do not give

rtsearch and schedule_rtsearch

else you can also go and edit authorize.conf to create a role. Please check the below sample role

[role_limited_user]
change_own_password = enabled
embed_report = enabled
get_metadata = enabled
get_typeahead = enabled
input_file = enabled
list_deployment_client = enabled
list_forwarders = enabled
list_inputs = enabled
output_file = enabled
request_remote_tok = enabled
rest_apps_view = enabled
rest_properties_get = enabled
run_debug_commands = enabled
search = enabled
schedule_search = enabled

this settings limited there maxium search window below is two weeks in seconds

srchTimeWin = 1209600

leave this capabilility commented out

rtsearch = enabled

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

paramagurukarth — Mon, 04 Dec 2017 05:27:05 GMT

If you want, You can do it using a simple css fix

If you are using simple xml. Add a html module like below,

<form onUnloadCancelJobs="True">
    <label>test_css</label>
    <row>
        <panel>
            <input type="time" token="field1" searchWhenChanged="true">
            <label>Time Range</label>
            <default>
                <earliest>-24h@h</earliest>
                <latest>now</latest>
            </default>
            </input>
            <html>
            <style>
                /* This is to remove the  "All Time (Real Time)" under "Preset"*/

                .presets-group a[data-earliest="rt"] {
                    display: none;
                }
            </style>

            </html>
        </panel>
    </row>
</form>

Add it to the end of last panel so that you can avoid unwanted padding/margin spaced added by html module

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

HattrickNZ — Mon, 04 Dec 2017 19:29:58 GMT

tks, css is the kind of solution I am looking for but I could not get this to work but see my edit1, I have included the html code, in the Question. As maybe the css can be slightly edited to work on that html?

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

HattrickNZ — Mon, 04 Dec 2017 19:30:33 GMT

tks but would like to do it in the simple xml if possible.

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

MuS — Mon, 04 Dec 2017 19:51:30 GMT

Hi HattrickNZ,

you can hide the real-time presets using this css:

/* hide real-time accordion */
 div[id^='realtime_view'] {
   display: none;
 }
 /* hide real-time presets */
 div[id^='presets_view'] > div.accordion-body > div > ul:nth-child(1) {
   display:none;
 }
 /* hide divider after real-time presets */
 div[id^='presets_view'] > div.accordion-body > div > div:nth-child(2) {
   display:none;
 }

Put it in your app directory in app server/static and use it in the dash board with stylesheet="yourcssfilenamehere.css", depending on your Splunk version you can either restart Splunkweb or _bump it by accessing this URL http[s]?://<SPLUNK_IP_ADDRESS>:8000/en-GB/_bump.

After that the real-time presets are hidden:

But one can still used them with the advanced options in the time range picker, so you additionally need to remove the rtsearch capabilities from the user role to make sure user don't run a manual real-time search.

Hope this helps ...

cheers, MuS

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

HattrickNZ — Mon, 04 Dec 2017 20:22:28 GMT

can I put the css in the xml code like @paramagurukarthikeyan mentions below? That would be the ideal.

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

MuS — Mon, 04 Dec 2017 20:30:37 GMT

It fails for me when trying inline....

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

paramagurukarth — Tue, 05 Dec 2017 08:09:25 GMT

Sorry I missed the trailing comment char (*/) in my css
Please see the updated complete xml in my answer

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

ss026381 — Mon, 09 Apr 2018 16:54:48 GMT

Is there a way to hide accordions from first time picker and show everything from the second time picker.

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

derekarnold — Sat, 28 Apr 2018 23:14:57 GMT

This doesn't work, at least in version 7

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

paxtaru — Mon, 16 Sep 2019 22:11:48 GMT

Thanks for all the notes here and I finally figured it out... Basically we have to set display:none to all the div that is used by the real-time search criteria. I used the inspector to find the div element and the associated string that is used to match in the CSS stylesheet.

Here's the example of what I did, and as Splunk updates their software this might change in the future too:

When viewing source of the time picker, this is the code:

  <fieldset submitButton="false">
    <input type="time" token="timefield" searchWhenChanged="true">
      <label>Please enter a timeframe</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <!-- Added to remove real-time column and panel -->
    <html>
      <style>
         div[data-test="real-time-column"] {
             display: none;
         }
         div[data-test-panel-id="realTime"] {
             display: none;
         }
      </style>
    </html>
    <!-- End manual modification -->
  </fieldset>

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

dmarling — Mon, 07 Oct 2019 17:27:07 GMT

I just realized I gave the same answer and you had the solution I came up with too.

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

danielbb — Wed, 12 Aug 2020 18:44:13 GMT

@MuS- where is the location of this HTML/CSS file with the date/time options?

Re: Is there a way to remove the `Real-time` part that appears from the drop down time picker

MuS — Wed, 12 Aug 2020 22:27:11 GMT

Hi there,

nowadays this can be configured in the Splunk UI under `Settings - User Interface - Time Ranges`

cheers, MuS