I would like to remove the realtime searches that get kicked off automatically when a user is on the following pages
/en-US/app/launcher/home (Data Panel)
/en-US/app/search/search (What to Search Panel)
This is the search that gets kicked off if you visit those pages
| metadata type=sourcetypes | search totalCount > 0
Anyone know what edits need to be made and where need to stop them from happening?
In Splunk version 6.2 you may disable the real time searches by adding the following two lines to the ui-prefs.conf file.
display.prefs.enableMetaData=0
display.prefs.showDataSummary=0
Edit the JavaScripts are no longer required.
If above solution does not solve it, you need to remove user specific config. See solution provided in Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not bein...
In Splunk version 6.2 you may disable the real time searches by adding the following two lines to the ui-prefs.conf file.
display.prefs.enableMetaData=0
display.prefs.showDataSummary=0
This works perfectly, I just turned off the first one that disables the MetaData search, I retained the Data Summary button since some of my users utilize it.
This should be the default. Or at least a bolded "BEST PRACTICE" for anything more than a small single server installation.
Do these settings turn off ALL metadata searching? Or are these specifically for those searches in the landing page?
No. These settings disables metadata searches in the landing page ONLY.
This setting doesn't seem to be working in 6.5.3.
It worked for me in 6.5.3. Please be sure to make the change under $SPLUNK_HOME/etc/system/local/ui-prefs.conf
file. Changes made anywhere else will have low precedence.
This answers thread should be considered an ER to remove or significantly modify these panels. RT search is a drain and customers can not afford to have to chase down users and/or spend time maintaining modifications to disable this "feature".
We've been waiting on support for months for a hack to disable the JS and have been told that this "feature" will be configurable in version 6.2.
This is now currently configurable in 6.2. See answer below for configuration parameters in iu-prefs.conf.
Can someone from Splunk chime in here? This exhausts our pool of realtime searches that are made available almost instantly when all of our end users login.
That's hardwired into the JavaScript. For example, the home page data panel's search is in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/routers/Homepage.js
, around line 400 in method startMetaDataSearch
. Note - changes in there require rebuilding the compiled file $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/build/homepage.js
, won't survive an update, and won't be supported.
See configuration available in 6.2, details below.