Dashboards & Visualizations

How does Deployment Monitor Dashboard suppress time range messages?

sf_user_199
Path Finder

In the Deployment Monitor App, on the main dashboard there is the Index Throughput graph - which runs the "DM indexthru today vs last week" saved search.

When you view the dashboard, there are no time range messages. I copied the dashboard's XML & search, and substituted my own search values (the search is essentially the same). When I run it, however, I get the following message: "[subsearch]: Your timerange was substituted based on your search string".

If I modify the XMl to have this:


splunk.search.job
True
0

Then the error message goes away, but I think this will suppress all error messages. My question then is this - Why does your search not show the time range message, but mine does?

1 Solution

sideview
SplunkTrust
SplunkTrust

This code serves pretty well. I believe the Deployment Monitor app uses the same thing or something very similar. Paste this into /etc/apps/<appname>/appserver/static/application.js. You may have to create the file if the given app doesn't have one already, and you have to do it in every app that you need the suppression in.

/**
 * Customize the message module so it wont constantly be telling the user that
 * lookup tables have been loaded and written to.
 * Unfortunately this is the least evil way I was able to find to
 * override the message handling.
 */
if (Splunk.Module.Message) {
    Splunk.Module.Message= $.klass(Splunk.Module.Message, {
        getHTMLTransform: function($super){
            // Please dont tell me any 'info' about lookups, nor 'error' about entityLabelSingular, etc...
            // Thank you that is all.
            var argh = [
                {contains:"lookup", level:"info"},
                {contains:"Results written to", level:"info"},
                {contains:"entityLabelSingular", level:"error"},
                {contains:"auto-finalized", level:"info"},
                {contains:"Your timerange was substituted", level:"info"},
                {contains:"Specified field(s) missing from results", level:"warn"}
            ];
            for (var i=0,len=this.messages.length; i<len; i++){
                var message = this.messages[i];
                for (var j=0,jLen=argh.length;j<jLen;j++) {
                    if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {

                        this.messages.splice(i,1);
                        break;
                    }
                }
            }
            return $super();
        }
    });
}

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

This code serves pretty well. I believe the Deployment Monitor app uses the same thing or something very similar. Paste this into /etc/apps/<appname>/appserver/static/application.js. You may have to create the file if the given app doesn't have one already, and you have to do it in every app that you need the suppression in.

/**
 * Customize the message module so it wont constantly be telling the user that
 * lookup tables have been loaded and written to.
 * Unfortunately this is the least evil way I was able to find to
 * override the message handling.
 */
if (Splunk.Module.Message) {
    Splunk.Module.Message= $.klass(Splunk.Module.Message, {
        getHTMLTransform: function($super){
            // Please dont tell me any 'info' about lookups, nor 'error' about entityLabelSingular, etc...
            // Thank you that is all.
            var argh = [
                {contains:"lookup", level:"info"},
                {contains:"Results written to", level:"info"},
                {contains:"entityLabelSingular", level:"error"},
                {contains:"auto-finalized", level:"info"},
                {contains:"Your timerange was substituted", level:"info"},
                {contains:"Specified field(s) missing from results", level:"warn"}
            ];
            for (var i=0,len=this.messages.length; i<len; i++){
                var message = this.messages[i];
                for (var j=0,jLen=argh.length;j<jLen;j++) {
                    if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {

                        this.messages.splice(i,1);
                        break;
                    }
                }
            }
            return $super();
        }
    });
}
0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid you cannot. You have to go on the host and add it to the application.js file manually.

0 Karma

therealdpk
Path Finder

How do you add this code from the web?

0 Karma

sideview
SplunkTrust
SplunkTrust

Well in 4.2.3 it's this.messages, and there is no this.displayedMessages anywhere as far as I can tell. So I guess you're saying that you're working on the newer version and someone has changed the Message module enough where the patch doesn't work. In that case there may be more than that one problem fwiw.

0 Karma

Archana
Splunk Employee
Splunk Employee

Per araitz, use this.diplayedMessages instead of this.messages

0 Karma

Archana
Splunk Employee
Splunk Employee

Nick, this code snippet produces the following error in web_service.log:
2011-11-11 14:18:34,698 ERROR [4ebd9f3ab11bb1aa90] utility:63 - name=javascript, class=Splunk.Error, lineNumber=54, message=this.messages is undefined, fileName=/application.js

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...