Splunk Search

How to remove automatic real-time searches that run when users visit the Home page and Search app?

Builder

I would like to remove the realtime searches that get kicked off automatically when a user is on the following pages

/en-US/app/launcher/home (Data Panel)
/en-US/app/search/search (What to Search Panel)

This is the search that gets kicked off if you visit those pages
| metadata type=sourcetypes | search totalCount > 0

Anyone know what edits need to be made and where need to stop them from happening?

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

In Splunk version 6.2 you may disable the real time searches by adding the following two lines to the ui-prefs.conf file.

display.prefs.enableMetaData=0
display.prefs.showDataSummary=0

View solution in original post

Path Finder

Edit the JavaScripts are no longer required.

If above solution does not solve it, you need to remove user specific config. See solution provided in Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not bein... 

0 Karma

Splunk Employee
Splunk Employee

In Splunk version 6.2 you may disable the real time searches by adding the following two lines to the ui-prefs.conf file.

display.prefs.enableMetaData=0
display.prefs.showDataSummary=0

View solution in original post

Path Finder

This works perfectly, I just turned off the first one that disables the MetaData search, I retained the Data Summary button since some of my users utilize it.

0 Karma

Influencer

This should be the default. Or at least a bolded "BEST PRACTICE" for anything more than a small single server installation.

0 Karma

Path Finder

Do these settings turn off ALL metadata searching? Or are these specifically for those searches in the landing page?

0 Karma

Motivator

No. These settings disables metadata searches in the landing page ONLY.

Contributor

This setting doesn't seem to be working in 6.5.3.

0 Karma

Motivator

It worked for me in 6.5.3. Please be sure to make the change under $SPLUNK_HOME/etc/system/local/ui-prefs.conf file. Changes made anywhere else will have low precedence.

0 Karma

Champion

This answers thread should be considered an ER to remove or significantly modify these panels. RT search is a drain and customers can not afford to have to chase down users and/or spend time maintaining modifications to disable this "feature".

Champion

We've been waiting on support for months for a hack to disable the JS and have been told that this "feature" will be configurable in version 6.2.

Splunk Employee
Splunk Employee

This is now currently configurable in 6.2. See answer below for configuration parameters in iu-prefs.conf.

0 Karma

Explorer

Can someone from Splunk chime in here? This exhausts our pool of realtime searches that are made available almost instantly when all of our end users login.

SplunkTrust
SplunkTrust

That's hardwired into the JavaScript. For example, the home page data panel's search is in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/routers/Homepage.js, around line 400 in method startMetaDataSearch. Note - changes in there require rebuilding the compiled file $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/build/homepage.js, won't survive an update, and won't be supported.

Splunk Employee
Splunk Employee

See configuration available in 6.2, details below.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!