We would like to disallow our users to use real-time searches. Where do we block the feature from the users?
Did you check this
https://community.splunk.com/t5/Dashboards-Visualizations/Is-there-a-way-to-remove-the-Real-time-par...
https://community.splunk.com/t5/Dashboards-Visualizations/How-to-hide-Real-Time-Presets-option-in-th...
Where is the location of this css file that lists the date/time selection options?