topic Re: How to remove automatic real-time searches that run when users visit the Home page and Search app? in Splunk Search

How to remove automatic real-time searches that run when users visit the Home page and Search app?

cramasta — Thu, 19 Jun 2014 15:26:54 GMT

I would like to remove the realtime searches that get kicked off automatically when a user is on the following pages

/en-US/app/launcher/home (Data Panel)
/en-US/app/search/search (What to Search Panel)

This is the search that gets kicked off if you visit those pages
| metadata type=sourcetypes | search totalCount > 0

Anyone know what edits need to be made and where need to stop them from happening?

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

martin_mueller — Thu, 19 Jun 2014 20:06:01 GMT

That's hardwired into the JavaScript. For example, the home page data panel's search is in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/routers/Homepage.js, around line 400 in method startMetaDataSearch. Note - changes in there require rebuilding the compiled file $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/build/homepage.js, won't survive an update, and won't be supported.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

jstacey_intuit — Wed, 03 Sep 2014 20:42:45 GMT

Can someone from Splunk chime in here? This exhausts our pool of realtime searches that are made available almost instantly when all of our end users login.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

the_wolverine — Wed, 10 Sep 2014 05:10:04 GMT

This answers thread should be considered an ER to remove or significantly modify these panels. RT search is a drain and customers can not afford to have to chase down users and/or spend time maintaining modifications to disable this "feature".

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

the_wolverine — Wed, 24 Sep 2014 22:57:18 GMT

We've been waiting on support for months for a hack to disable the JS and have been told that this "feature" will be configurable in version 6.2.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

bpaul_splunk — Tue, 03 Feb 2015 21:08:46 GMT

In Splunk version 6.2 you may disable the real time searches by adding the following two lines to the ui-prefs.conf file.

display.prefs.enableMetaData=0
display.prefs.showDataSummary=0

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

ltang_splunk — Tue, 03 Feb 2015 21:12:53 GMT

This is now currently configurable in 6.2. See answer below for configuration parameters in iu-prefs.conf.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

ltang_splunk — Tue, 03 Feb 2015 21:13:30 GMT

See configuration available in 6.2, details below.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

sherm77 — Wed, 11 Feb 2015 14:52:04 GMT

This works perfectly, I just turned off the first one that disables the MetaData search, I retained the Data Summary button since some of my users utilize it.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

jagadeeshm — Wed, 27 Sep 2017 20:12:12 GMT

This setting doesn't seem to be working in 6.5.3.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

ridwanahmed — Fri, 27 Jul 2018 18:20:39 GMT

Do these settings turn off ALL metadata searching? Or are these specifically for those searches in the landing page?

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

sudosplunk — Fri, 27 Jul 2018 19:34:38 GMT

No. These settings disables metadata searches in the landing page ONLY.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

sudosplunk — Fri, 27 Jul 2018 19:36:37 GMT

It worked for me in 6.5.3. Please be sure to make the change under $SPLUNK_HOME/etc/system/local/ui-prefs.conf file. Changes made anywhere else will have low precedence.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

twinspop — Wed, 22 Aug 2018 16:42:08 GMT

This should be the default. Or at least a bolded "BEST PRACTICE" for anything more than a small single server installation.

Re: How to remove automatic real-time searches that run when users visit the Home page and Search app?

pellegrini — Tue, 01 Dec 2020 11:22:00 GMT

Edit the JavaScripts are no longer required.

If above solution does not solve it, you need to remove user specific config. See solution provided in Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not being respected