The answer @somesoni2 linked to is part of the answer but not all of it.
Here is the way to just remove the Real-Time presets options and the Real-Time accordion entry.
Open up dashboard.css in your app. If you don't have one already, then create one in /appserver/static.
Add the following to dashboard.css
/* hide real-time accordion */
div[id^='realtime_view'] {
display: none;
}
/* hide real-time presets */
div[id^='presets_view'] > div.accordion-body > div > ul:nth-child(1) {
display:none;
}
/* hide divider after real-time presets */
div[id^='presets_view'] > div.accordion-body > div > div:nth-child(2) {
display:none;
}
After making those changes you will have to restart Splunk if you created dashboard.css or "bump" Splunk if it already existed. The latter involves going to http://<SPLUNK_IP_ADDRESS>:8000/en-US/_bump and clicking the button. Then you can reload a dashboard in your app and confirm the real-time options are missing.
