Dashboards & Visualizations

How can you get rid of the GUI notifications

Contributor

When I run a search on my custom dashboard, I get a notification bar on top stating the status of the dashboard queries. Here are some of the examples:

This view references scheduled searches that do not run automatically in Free Splunk. Please wait while they run now.

[subsearch]: Successfully read lookup file 'C:\Program Files\Splunk\etc\apps\customapp\lookups\search_list.csv'.

I want to get rid of these notifications, is there a way?

1 Solution

Builder

Which Splunk version are you asking about?

If you are building a custom view in Splunk 4.x using the "advanced XML" type, you can control the notifications from within the XML. The documentation for the "Message" module that controls the notifications is here: http://www.splunk.com/base/Documentation/4.0.10/Developer/ModuleReference#Message

Here is an example of what I use to show up to a maximum of one notification at a time, you could probably block them completely by setting a maxSize of 0.

(this may not display well as it has greater and less than signs, which can screw up html)

<view template="dashboard.html">
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
...

View solution in original post

Builder

Which Splunk version are you asking about?

If you are building a custom view in Splunk 4.x using the "advanced XML" type, you can control the notifications from within the XML. The documentation for the "Message" module that controls the notifications is here: http://www.splunk.com/base/Documentation/4.0.10/Developer/ModuleReference#Message

Here is an example of what I use to show up to a maximum of one notification at a time, you could probably block them completely by setting a maxSize of 0.

(this may not display well as it has greater and less than signs, which can screw up html)

<view template="dashboard.html">
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
...

View solution in original post

Splunk Employee
Splunk Employee

Oh sorry, you can also completely remove the messages module, so just delete the entire block that Glenn pasted above.

0 Karma

Splunk Employee
Splunk Employee

If you're using Splunk 4.1, you can append "?showsource=true" to the end of your view URI, like this:

http://localhost:8000/en-US/app/search/dashboard?showsource=true

Then, scroll down to the bottom til you see "XML source." Take this XML -- it is the advanced XML syntax -- and paste it into the view edit window in Manager to overwrite your simplified XML. Then, remove the messages module as Glenn described.

If you're not using 4.1, you will have to migrate your XML by hand.

0 Karma

Contributor

So you will have to create an app with the advanced XML?

0 Karma

Builder

Sure. As I mentioned up there, this is for the advanced xml syntax views only. The view template tag is actually the start of an advanced xml view, so including it in a simple dashboard will not work. You could try to exclude that view template line, and only include the other lines at the top of your simple view, but I'm fairly sure the module xml tags are incompatible with simple view.

I do not know how to do what you need in simple xml I'm afraid.

0 Karma

Contributor

This actually did not work. Is the view template necessary? My dashboard is very simple and uses the default dashboard/view.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!