topic Re: Splunk dashboard in Dashboards & Visualizations

Splunk dashboard

LogUx — Sat, 25 Jul 2020 18:14:56 GMT

How to hide this message in dashboard ?

Re: Splunk dashboard

The_Simko — Sat, 25 Jul 2020 19:36:57 GMT

In your search, you could try to place splunk_server=local in the search.

Assuming you intend it to be ran only on the SH, then it's even better than masking the message.

Re: Splunk dashboard

niketn — Sun, 26 Jul 2020 16:29:55 GMT

@LogUx the dispatch_rest_to_indexers is usually granted to folks with Admin roles. If it is not provisioned results are returned locally from SH. As far as you are getting the result back you would not need to grant the role access to the users whom you do not want to push REST request to Indexers.

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities

Re: Splunk dashboard

richgalloway — Sun, 26 Jul 2020 19:55:07 GMT

IME, there is no way to suppress that message. Even using splunk_server=local does not help.

I've submitted a suggestion at https://ideas.splunk.com/ideas/EID-I-329 to hide such messages. Please consider up-voting it.

Re: Splunk dashboard

LogUx — Mon, 27 Jul 2020 05:40:32 GMT

@richgalloway Correct, i checked with splunk_server=local, but is not working.

Re: Splunk dashboard

LogUx — Mon, 27 Jul 2020 05:41:14 GMT

@The_Simko Yes i tried but it is not working

Re: Splunk dashboard

LogUx — Mon, 27 Jul 2020 05:42:07 GMT

@niketn Thanks for your suggestion