Please help to understand why i am not able remove Remove real time option from timepicker from complete Splunk.
1. I disable real time menu in setting->user-interface->timeranges it does not work
2. I also edit in config file mention in some different answers provided by Splunkers
3. The only way works is add dashboard.css and reference into dashboard but it only disable for dashboard only.
Please help, it's really be appreciated.
We removed real time searching by editing user roles. For all roles, we removed the capability to run or schedule real-time searches. This removed "real time" from the all timepickers.
Hmm, that's odd. In my Splunk search head, I am an admin. If I add
rtsearch to my list of capabilities, I immediately see "real time" as an option in all timepickers. If I remove it, the option no longer appears. You might also check to see for the capability
schedule_rtsearch, but beyond that I'm stumped.
Is your user a member of multiple roles? It might be that
rtsearch is enabled for another role assigned to your user, since capabilities for a user are a superset of all capabilities assigned to all roles for which that user is a member.