I have been trialling the Enterprise version and tweaking so I could fit under the 500MB/day limit (we're a startup, no way to shell out US$6k yet), and one of the things I was testing was a scheduled search for a dashboard.
Now that I've applied the free license to the indexer, I'd like to remove that nagging reminder that says "Search scheduler is disabled in Splunk Free, including scheduled searches used to fill summary indexes. Dashboards using summary indexes may not work."
You can override the default behavior of the Message Module on a per app basis.
A very smart man I know did it like this (though I might use jquery's '$.each' myself):
<app>/appserver/static/application.js:
if (Splunk.Module.Message) {
Splunk.Module.Message= $.klass(Splunk.Module.Message, {
getHTMLTransform: function($super){
// Ignore the following message(s)
var argh = [
{contains:"Search scheduler is disabled in Splunk Free", level:"info"},
];
for (var i=0,len=this.messages.length; i<len; i++){
var message = this.messages[i];
for (var j=0,jLen=argh.length;j<jLen;j++) {
if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {
this.messages.splice(i,1);
break;
}
}
}
return $super();
}
});
}
You can override the default behavior of the Message Module on a per app basis.
A very smart man I know did it like this (though I might use jquery's '$.each' myself):
<app>/appserver/static/application.js:
if (Splunk.Module.Message) {
Splunk.Module.Message= $.klass(Splunk.Module.Message, {
getHTMLTransform: function($super){
// Ignore the following message(s)
var argh = [
{contains:"Search scheduler is disabled in Splunk Free", level:"info"},
];
for (var i=0,len=this.messages.length; i<len; i++){
var message = this.messages[i];
for (var j=0,jLen=argh.length;j<jLen;j++) {
if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {
this.messages.splice(i,1);
break;
}
}
}
return $super();
}
});
}
it's true, unless the
Did you try it? Yes, application.js is upgrade safe - if it weren't, apps wouldn't be upgrade safe either.
What happens when you upgrade Splunk? Does this 'hack' stick?