topic Re: Red Error/Warning Bar in Splunk in Dashboards & Visualizations

Red Error/Warning Bar in Splunk

Ant1D — Fri, 15 Oct 2010 00:01:17 GMT

Hey,

How can I remove/hide the red error bar which is displayed across the Splunk UI whenever an error occurs?

Thanks in advance for your help

Re: Red Error/Warning Bar in Splunk

brettgladys — Fri, 15 Oct 2010 00:11:45 GMT

You can edit the view and take out the Message module...

...

While this will remove it, you'll also not receive the messages you might need.

Re: Red Error/Warning Bar in Splunk

sideview — Fri, 15 Oct 2010 00:12:15 GMT

If your view (page) is written using the Simplified XML then there are a couple tricks but they're complicated or hacky or both.

However if you're already using the Advanced XML it's quite easy -- navigate to Manager > User Interface > Views > <your view here>

you should see some module tags with class="Message".

<module class="Message">
    ...stuff...
</module>

The 2 at the top are generally the ones that are responsible for displaying errors. You can just carefully comment those out. I don't really recommend this because I find that when people do this, a week or two later they'll be tearing their hair out with something that's not working and it ends up being because they have no way of seeing the error message that would make them slap their forehead...

So.... if you want to be more fine grained about it, (and sadly the Message module doesn't have very useful filtering), but you can follow the technique that the 'discover' app uses. Download that app from splunkbase, look in /appserver/static/application.js for references to Splunk.Module.Message and read the comments there. If you copy that block of javascript into your app you'll be able to do some useful filtering on what actual messages it does and does not display.

If you're stuck with the simplified XML and/or dont want to muck with application.js you can apply some CSS from /application/static/application.css to just suppress the display of the message module entirely::

div.Message {
    display:none;
}

but for the same reason I mention above, I'd only do this if you really really need to. And you might need to put it back when you're debugging.

Re: Red Error/Warning Bar in Splunk

Ant1D — Tue, 19 Oct 2010 22:03:49 GMT

Thanks Nick. I understand what you are saying. Maybe I will switch it off when I am doing demos of my Splunk instance and then turn it back on when I am doing testing/debugging

Re: Red Error/Warning Bar in Splunk

Ant1D — Tue, 19 Oct 2010 22:05:42 GMT

The error message bar doesn't usually contain much helpful information

Re: Red Error/Warning Bar in Splunk

Ant1D — Tue, 19 Oct 2010 22:09:36 GMT

Thanks for the info brettgladys

Re: Red Error/Warning Bar in Splunk

sideview — Thu, 21 Oct 2010 13:17:20 GMT

It will display search language errors though, like if you're not using quite the right argument and the report isnt working - that's the only clue you'll get.

Re: Red Error/Warning Bar in Splunk

baerts — Mon, 28 Sep 2020 19:24:19 GMT

Hey All,

Within spunk 6.2.2, Is the Messages facility (menu bar) better controllable? Turn it off or filter out system vs user related messages for display etc.
I see reference in scripts (under templates/lib.html) like:

if 'common.min.js' not in seen:
% if disable_messenger:

% endif

But not much documentation on how this would work.

Thank you!

Re: Red Error/Warning Bar in Splunk

shashank20 — Wed, 04 Dec 2019 16:40:28 GMT

i am unable to remove yellow warning error coming out of splunk enterprise dashboard