You should be able to achieve this by doing the following:
(Splunk 6.X Systems)
1. Settings
2. User Interface
3. Change App context to "All"
4. Identify time in list
5. Select Disabled
6. repeat for each time instances you wish to disable.
Just for the benefit of others who are looking for the same, adding this in system/local/times.conf
[all_time]
disabled = 1
[real_time_last30s]
disabled = 1
[real_time_last1m]
disabled = 1
[real_time_last5m]
disabled = 1
[real_time_last30m]
disabled = 1
[real_time_last1h]
disabled = 1
[real_time_all]
disabled = 1
[settings]
show_realtime = false
You should be able to achieve this by doing the following:
(Splunk 6.X Systems)
1. Settings
2. User Interface
3. Change App context to "All"
4. Identify time in list
5. Select Disabled
6. repeat for each time instances you wish to disable.
Hi,
Real time menu got disabled but still it is showing advanced menu. How to do this?