Dashboards & Visualizations

Splunk dashboard

uagraw01
Motivator

IMG_20200725_231624__01.jpg

 How to hide this message in dashboard ?

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

IME, there is no way to suppress that message.  Even using splunk_server=local does not help.

I've submitted a suggestion at https://ideas.splunk.com/ideas/EID-I-329 to hide such messages.  Please consider up-voting it.

---
If this reply helps you, Karma would be appreciated.

uagraw01
Motivator

@richgalloway Correct, i checked with splunk_server=local, but is not working.

0 Karma

niketn
Legend

@uagraw01 the dispatch_rest_to_indexers is usually granted to folks with Admin roles.  If it is not provisioned results are returned locally from SH. As far as you are getting the result back you would not need to grant the role access to the users whom you do not want to push REST request to Indexers.

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

uagraw01
Motivator

@niketn Thanks for your suggestion

0 Karma

The_Simko
Path Finder

In your search, you could try to place splunk_server=local in the search.

Assuming you intend it to be ran only on the SH, then it's even better than masking the message.

uagraw01
Motivator

@The_Simko Yes i tried but it is not working

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...