Dashboards & Visualizations

How does Deployment Monitor Dashboard suppress time range messages?

sf_user_199
Path Finder

In the Deployment Monitor App, on the main dashboard there is the Index Throughput graph - which runs the "DM indexthru today vs last week" saved search.

When you view the dashboard, there are no time range messages. I copied the dashboard's XML & search, and substituted my own search values (the search is essentially the same). When I run it, however, I get the following message: "[subsearch]: Your timerange was substituted based on your search string".

If I modify the XMl to have this:


splunk.search.job
True
0

Then the error message goes away, but I think this will suppress all error messages. My question then is this - Why does your search not show the time range message, but mine does?

1 Solution

sideview
SplunkTrust
SplunkTrust

This code serves pretty well. I believe the Deployment Monitor app uses the same thing or something very similar. Paste this into /etc/apps/<appname>/appserver/static/application.js. You may have to create the file if the given app doesn't have one already, and you have to do it in every app that you need the suppression in.

/**
 * Customize the message module so it wont constantly be telling the user that
 * lookup tables have been loaded and written to.
 * Unfortunately this is the least evil way I was able to find to
 * override the message handling.
 */
if (Splunk.Module.Message) {
    Splunk.Module.Message= $.klass(Splunk.Module.Message, {
        getHTMLTransform: function($super){
            // Please dont tell me any 'info' about lookups, nor 'error' about entityLabelSingular, etc...
            // Thank you that is all.
            var argh = [
                {contains:"lookup", level:"info"},
                {contains:"Results written to", level:"info"},
                {contains:"entityLabelSingular", level:"error"},
                {contains:"auto-finalized", level:"info"},
                {contains:"Your timerange was substituted", level:"info"},
                {contains:"Specified field(s) missing from results", level:"warn"}
            ];
            for (var i=0,len=this.messages.length; i<len; i++){
                var message = this.messages[i];
                for (var j=0,jLen=argh.length;j<jLen;j++) {
                    if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {

                        this.messages.splice(i,1);
                        break;
                    }
                }
            }
            return $super();
        }
    });
}

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

This code serves pretty well. I believe the Deployment Monitor app uses the same thing or something very similar. Paste this into /etc/apps/<appname>/appserver/static/application.js. You may have to create the file if the given app doesn't have one already, and you have to do it in every app that you need the suppression in.

/**
 * Customize the message module so it wont constantly be telling the user that
 * lookup tables have been loaded and written to.
 * Unfortunately this is the least evil way I was able to find to
 * override the message handling.
 */
if (Splunk.Module.Message) {
    Splunk.Module.Message= $.klass(Splunk.Module.Message, {
        getHTMLTransform: function($super){
            // Please dont tell me any 'info' about lookups, nor 'error' about entityLabelSingular, etc...
            // Thank you that is all.
            var argh = [
                {contains:"lookup", level:"info"},
                {contains:"Results written to", level:"info"},
                {contains:"entityLabelSingular", level:"error"},
                {contains:"auto-finalized", level:"info"},
                {contains:"Your timerange was substituted", level:"info"},
                {contains:"Specified field(s) missing from results", level:"warn"}
            ];
            for (var i=0,len=this.messages.length; i<len; i++){
                var message = this.messages[i];
                for (var j=0,jLen=argh.length;j<jLen;j++) {
                    if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {

                        this.messages.splice(i,1);
                        break;
                    }
                }
            }
            return $super();
        }
    });
}
0 Karma

sideview
SplunkTrust
SplunkTrust

I'm afraid you cannot. You have to go on the host and add it to the application.js file manually.

0 Karma

therealdpk
Path Finder

How do you add this code from the web?

0 Karma

sideview
SplunkTrust
SplunkTrust

Well in 4.2.3 it's this.messages, and there is no this.displayedMessages anywhere as far as I can tell. So I guess you're saying that you're working on the newer version and someone has changed the Message module enough where the patch doesn't work. In that case there may be more than that one problem fwiw.

0 Karma

Archana
Splunk Employee
Splunk Employee

Per araitz, use this.diplayedMessages instead of this.messages

0 Karma

Archana
Splunk Employee
Splunk Employee

Nick, this code snippet produces the following error in web_service.log:
2011-11-11 14:18:34,698 ERROR [4ebd9f3ab11bb1aa90] utility:63 - name=javascript, class=Splunk.Error, lineNumber=54, message=this.messages is undefined, fileName=/application.js

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...