this settings limited there maxium search window below is two weeks in seconds

HattrickNZ · ‎12-03-2017

Is there a way to remove the realtime search option from my dropdown time picker.

example of code:

  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliestTime>-24h@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="dropdown" token="time_span">
      <label>Time Span:</label>
      <choice value="5m">5m</choice>
      <default>5m</default>
    </input>
  </fieldset>

Example of time-picker: Is there a way to remove the Real-time part that appears from the drop down time picker(highlighted in red)?

EDIT1 - This is the html code(when I do an inspect element on the dropdown) for the "Real-time" part of my pic above(The bit highlight in red). This is what I would like to remove, and as suggessted below, maybe css is the way to do it. Just not sure of the css to remove it.

   <div class="accordion-inner presets-container shared-timerangepicker-dialog-presets" data-cid="view112564" data-view="views/shared/timerangepicker/dialog/Presets" data-render-time="0.002">
    <ul class="unstyled presets-group">
        <li>Real-time</li>
        <li><a href="#" data-earliest="rt-30s" data-latest="rt">30 second window</a></li>           
        <li><a href="#" data-earliest="rt-1m" data-latest="rt">1 minute window</a></li>         
        <li><a href="#" data-earliest="rt-5m" data-latest="rt">5 minute window</a></li>         
        <li><a href="#" data-earliest="rt-30m" data-latest="rt">30 minute window</a></li>           
        <li><a href="#" data-earliest="rt-1h" data-latest="rt">1 hour window</a></li>           
        <li><a href="#" data-earliest="rt" data-latest="rt">All time (real-time)</a></li>           
    </ul>              
<div class="presets-divider-wrap">
<div class="presets-divider"></div></div>               
<ul class="unstyled presets-group">
    <li>Relative</li>
...

paxtaru · ‎09-16-2019

Thanks for all the notes here and I finally figured it out... Basically we have to set display:none to all the div that is used by the real-time search criteria. I used the inspector to find the div element and the associated string that is used to match in the CSS stylesheet.

Here's the example of what I did, and as Splunk updates their software this might change in the future too:

When viewing source of the time picker, this is the code:

  <fieldset submitButton="false">
    <input type="time" token="timefield" searchWhenChanged="true">
      <label>Please enter a timeframe</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <!-- Added to remove real-time column and panel -->
    <html>
      <style>
         div[data-test="real-time-column"] {
             display: none;
         }
         div[data-test-panel-id="realTime"] {
             display: none;
         }
      </style>
    </html>
    <!-- End manual modification -->
  </fieldset>

dmarling · ‎10-07-2019

I just realized I gave the same answer and you had the solution I came up with too.

If this comment/answer was helpful, please up vote it. Thank you.

ss026381 · ‎04-09-2018

Is there a way to hide accordions from first time picker and show everything from the second time picker.

MuS · ‎12-04-2017

Hi HattrickNZ,

you can hide the real-time presets using this css:

/* hide real-time accordion */
 div[id^='realtime_view'] {
   display: none;
 }
 /* hide real-time presets */
 div[id^='presets_view'] > div.accordion-body > div > ul:nth-child(1) {
   display:none;
 }
 /* hide divider after real-time presets */
 div[id^='presets_view'] > div.accordion-body > div > div:nth-child(2) {
   display:none;
 }

Put it in your app directory in app server/static and use it in the dash board with stylesheet="yourcssfilenamehere.css", depending on your Splunk version you can either restart Splunkweb or _bump it by accessing this URL http[s]?://<SPLUNK_IP_ADDRESS>:8000/en-GB/_bump.

After that the real-time presets are hidden:

But one can still used them with the advanced options in the time range picker, so you additionally need to remove the rtsearch capabilities from the user role to make sure user don't run a manual real-time search.

Hope this helps ...

cheers, MuS

danielbb · ‎08-12-2020

@MuS- where is the location of this HTML/CSS file with the date/time options?

MuS · ‎08-12-2020

Hi there,

nowadays this can be configured in the Splunk UI under `Settings - User Interface - Time Ranges`

cheers, MuS

HattrickNZ · ‎12-04-2017

can I put the css in the xml code like @paramagurukarthikeyan mentions below? That would be the ideal.

MuS · ‎12-04-2017

It fails for me when trying inline....

paramagurukarth · ‎12-03-2017

If you want, You can do it using a simple css fix

If you are using simple xml. Add a html module like below,

<form onUnloadCancelJobs="True">
    <label>test_css</label>
    <row>
        <panel>
            <input type="time" token="field1" searchWhenChanged="true">
            <label>Time Range</label>
            <default>
                <earliest>-24h@h</earliest>
                <latest>now</latest>
            </default>
            </input>
            <html>
            <style>
                /* This is to remove the  "All Time (Real Time)" under "Preset"*/

                .presets-group a[data-earliest="rt"] {
                    display: none;
                }
            </style>

            </html>
        </panel>
    </row>
</form>

Add it to the end of last panel so that you can avoid unwanted padding/margin spaced added by html module

derekarnold · ‎04-28-2018

This doesn't work, at least in version 7

HattrickNZ · ‎12-04-2017

tks, css is the kind of solution I am looking for but I could not get this to work but see my edit1, I have included the html code, in the Question. As maybe the css can be slightly edited to work on that html?

paramagurukarth · ‎12-05-2017

Sorry I missed the trailing comment char (*/) in my css
Please see the updated complete xml in my answer

kunalmao · ‎12-03-2017

you can try to add a user role and do not give

rtsearch and schedule_rtsearch

else you can also go and edit authorize.conf to create a role. Please check the below sample role

[role_limited_user]
change_own_password = enabled
embed_report = enabled
get_metadata = enabled
get_typeahead = enabled
input_file = enabled
list_deployment_client = enabled
list_forwarders = enabled
list_inputs = enabled
output_file = enabled
request_remote_tok = enabled
rest_apps_view = enabled
rest_properties_get = enabled
run_debug_commands = enabled
search = enabled
schedule_search = enabled

this settings limited there maxium search window below is two weeks in seconds

srchTimeWin = 1209600

leave this capabilility commented out

rtsearch = enabled

HattrickNZ · ‎12-04-2017

tks but would like to do it in the simple xml if possible.

Is there a way to remove the `Real-time` part that appears from the drop down time picker

this settings limited there maxium search window below is two weeks in seconds

leave this capabilility commented out

rtsearch = enabled

Introducing the 2024 SplunkTrust!

Introducing the 2024 Splunk MVPs!

Splunk Custom Visualizations App End of Life