Splunk dashboard

[uagraw01]

 How to hide this message in dashboard ?

[richgalloway]

IME, there is no way to suppress that message.  Even using splunk_server=local does not help.

I've submitted a suggestion at https://ideas.splunk.com/ideas/EID-I-329 to hide such messages.  Please consider up-voting it.

[uagraw01]

@richgalloway Correct, i checked with splunk_server=local, but is not working.

[niketn]

@uagraw01 the dispatch_rest_to_indexers is usually granted to folks with Admin roles.  If it is not provisioned results are returned locally from SH. As far as you are getting the result back you would not need to grant the role access to the users whom you do not want to push REST request to Indexers.

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities

[uagraw01]

@niketn Thanks for your suggestion

[The_Simko]

In your search, you could try to place splunk_server=local in the search.

Assuming you intend it to be ran only on the SH, then it's even better than masking the message.

[uagraw01]

@The_Simko Yes i tried but it is not working