Dashboards & Visualizations

How can you get rid of the GUI notifications

BunnyHop
Contributor

When I run a search on my custom dashboard, I get a notification bar on top stating the status of the dashboard queries. Here are some of the examples:

This view references scheduled searches that do not run automatically in Free Splunk. Please wait while they run now.

[subsearch]: Successfully read lookup file 'C:\Program Files\Splunk\etc\apps\customapp\lookups\search_list.csv'.

I want to get rid of these notifications, is there a way?

1 Solution

Glenn
Builder

Which Splunk version are you asking about?

If you are building a custom view in Splunk 4.x using the "advanced XML" type, you can control the notifications from within the XML. The documentation for the "Message" module that controls the notifications is here: http://www.splunk.com/base/Documentation/4.0.10/Developer/ModuleReference#Message

Here is an example of what I use to show up to a maximum of one notification at a time, you could probably block them completely by setting a maxSize of 0.

(this may not display well as it has greater and less than signs, which can screw up html)

<view template="dashboard.html">
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
...

View solution in original post

Glenn
Builder

Which Splunk version are you asking about?

If you are building a custom view in Splunk 4.x using the "advanced XML" type, you can control the notifications from within the XML. The documentation for the "Message" module that controls the notifications is here: http://www.splunk.com/base/Documentation/4.0.10/Developer/ModuleReference#Message

Here is an example of what I use to show up to a maximum of one notification at a time, you could probably block them completely by setting a maxSize of 0.

(this may not display well as it has greater and less than signs, which can screw up html)

<view template="dashboard.html">
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
...

View solution in original post

emma
Splunk Employee
Splunk Employee

Oh sorry, you can also completely remove the messages module, so just delete the entire block that Glenn pasted above.

0 Karma

emma
Splunk Employee
Splunk Employee

If you're using Splunk 4.1, you can append "?showsource=true" to the end of your view URI, like this:

http://localhost:8000/en-US/app/search/dashboard?showsource=true

Then, scroll down to the bottom til you see "XML source." Take this XML -- it is the advanced XML syntax -- and paste it into the view edit window in Manager to overwrite your simplified XML. Then, remove the messages module as Glenn described.

If you're not using 4.1, you will have to migrate your XML by hand.

0 Karma

BunnyHop
Contributor

So you will have to create an app with the advanced XML?

0 Karma

Glenn
Builder

Sure. As I mentioned up there, this is for the advanced xml syntax views only. The view template tag is actually the start of an advanced xml view, so including it in a simple dashboard will not work. You could try to exclude that view template line, and only include the other lines at the top of your simple view, but I'm fairly sure the module xml tags are incompatible with simple view.

I do not know how to do what you need in simple xml I'm afraid.

0 Karma

BunnyHop
Contributor

This actually did not work. Is the view template necessary? My dashboard is very simple and uses the default dashboard/view.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!