"Your timerange was substituted based on your search string" in my custom dashboard

[the_wolverine]

I'm creating a custom dashboard and am seeing this unsightly notice. Is there an easy way to disable these? My users do not need to know that the "timerange was subsituted based on your search string."

[wwhitener]

I had the same thing happen with me when we upgraded to 4.2.2 from 3.4.5. All of my saved searches were created in 3.4.5 and then spat out that "info" line.

I had to edit my saved searches, remove the startXXXago=99 (i.e. starthoursago=24 or startminsago=60) and put the time constraint in the drop down to the left/underneath. I then had to save it to the same query name.

The queries then gave me the answers without the INFO line. I suppose it was because of some kind of weirdness between versions?

[newaccount]

I'm lazy, but this will work; sends stderr to stdout and greps it away

/opt/splunk/bin/splunk search 'earliest=-5m' 2>&1|grep -v "INFO: Your timerange was substituted based on your search string"

[southeringtonp · Accepted solution]

You should be able to suppress it by modifying the filter in the Message module, but I'm not sure how to do it in a targeted way.

This may do what you want, but will suppress too much...

<module name="Message" layoutPanel="messaging">
        <param name="filter">splunk.search.error</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
</module>

I've been trying to do basically the same thing but haven't seen a good, granular way to exclude a single message.

[the_wolverine]

Good enough for me. Thank you!

[southeringtonp]

Also, just discovered another old post along these lines - http://answers.splunk.com/questions/3123/message-module-filter-values