Why can't I disable real-time from my Splunk search?

[anshul0915]

Hi all,
Please help to understand why i am not able remove Remove real time option from timepicker from complete Splunk.
1. I disable real time menu in setting->user-interface->timeranges it does not work
2. I also edit in config file mention in some different answers provided by Splunkers
3. The only way works is add dashboard.css and reference into dashboard but it only disable for dashboard only.
Please help, it's really be appreciated.

[elliotproebstel]

We removed real time searching by editing user roles. For all roles, we removed the capability to run or schedule real-time searches. This removed "real time" from the all timepickers.

[anshul0915]

You mean to remove rtsearch capability from user role right if that works for admin also . In my splunk setup admin dont have this capability selected still seeing this option

[elliotproebstel]

Hmm, that's odd. In my Splunk search head, I am an admin. If I add rtsearch to my list of capabilities, I immediately see "real time" as an option in all timepickers. If I remove it, the option no longer appears. You might also check to see for the capability schedule_rtsearch, but beyond that I'm stumped.

[elliotproebstel]

Is your user a member of multiple roles? It might be that rtsearch is enabled for another role assigned to your user, since capabilities for a user are a superset of all capabilities assigned to all roles for which that user is a member.