Splunk Search

How do I disable the free version's reminder that the search scheduler is disabled?

magu
Engager

I have been trialling the Enterprise version and tweaking so I could fit under the 500MB/day limit (we're a startup, no way to shell out US$6k yet), and one of the things I was testing was a scheduled search for a dashboard.

Now that I've applied the free license to the indexer, I'd like to remove that nagging reminder that says "Search scheduler is disabled in Splunk Free, including scheduled searches used to fill summary indexes. Dashboards using summary indexes may not work."

1 Solution

araitz
Splunk Employee
Splunk Employee

You can override the default behavior of the Message Module on a per app basis.

A very smart man I know did it like this (though I might use jquery's '$.each' myself):

<app>/appserver/static/application.js:

if (Splunk.Module.Message) {
    Splunk.Module.Message= $.klass(Splunk.Module.Message, {
        getHTMLTransform: function($super){
            // Ignore the following message(s)
            var argh = [
                {contains:"Search scheduler is disabled in Splunk Free", level:"info"},
            ];
            for (var i=0,len=this.messages.length; i<len; i++){
                var message = this.messages[i];
                for (var j=0,jLen=argh.length;j<jLen;j++) {
                    if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {
                        this.messages.splice(i,1);
                        break;
                    }
                }
            }
            return $super();
        }
    });
}

View solution in original post

araitz
Splunk Employee
Splunk Employee

You can override the default behavior of the Message Module on a per app basis.

A very smart man I know did it like this (though I might use jquery's '$.each' myself):

<app>/appserver/static/application.js:

if (Splunk.Module.Message) {
    Splunk.Module.Message= $.klass(Splunk.Module.Message, {
        getHTMLTransform: function($super){
            // Ignore the following message(s)
            var argh = [
                {contains:"Search scheduler is disabled in Splunk Free", level:"info"},
            ];
            for (var i=0,len=this.messages.length; i<len; i++){
                var message = this.messages[i];
                for (var j=0,jLen=argh.length;j<jLen;j++) {
                    if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {
                        this.messages.splice(i,1);
                        break;
                    }
                }
            }
            return $super();
        }
    });
}

sideview
SplunkTrust
SplunkTrust

it's true, unless the is 'search'. -- the "search" app ships application.js, and since the search app is itself shipped with the splunk server, an upgrade will clobber all changes to that particular application.js.

0 Karma

araitz
Splunk Employee
Splunk Employee

Did you try it? Yes, application.js is upgrade safe - if it weren't, apps wouldn't be upgrade safe either.

0 Karma

magu
Engager

What happens when you upgrade Splunk? Does this 'hack' stick?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...