Suppress search inspector?

[smisplunk]

If a search returns no results, the chart views will show "No results found" and will provide a mouse-over link to the search inspector. I'd like to suppress that for certain views. Is there an easy way to turn off the "More info..." link that is generated in these cases?

[sideview · Accepted solution]

You cant show or suppress the link by role, but you can hide it completely in those views by putting a little custom CSS into your app.

here's some general docs about custom CSS http://www.splunk.com/base/Documentation/latest/Developer/UseCSS

Create a file, call it whatever you like but put it in /etc/apps/<appname>/appserver/static/ And put the following lines inside it:

.resultStatusHelp { 
  display:none;
}

Then for each of those embedded views, put a stylesheet attribute into the top level tag (in this case the top level tag will be the <view> tag, in simplified XML it'd be in <form> or <dashboard>). assuming your file is appserver/static/custom.css, you'd put stylesheet="custom.css".

[Johnvey]

No, that functionality is built into the default panels. Is there a specific reason why you want to disable that link? Is there content on the inspection page that you don't want to expose?

[smisplunk]

In short, yes. We're utilizing SSO to link directly to some Splunk views (iFrame), and wish to obfuscate the direct URL of Splunk for a certain class (role) of user. Is there something in the roles that would disallow the search inspector popup?