Splunk Search

Supress Subsearch Warning

slierninja
Communicator

Is there a way to hide the splunk notification message:

[subsearch]: Your timerange was substituted based on your search string

I have a saved search that utilizes joins and each time I view the saved search in the dashboard it displays this notification in Splunk 4.2.

1 Solution

dwaddle
SplunkTrust
SplunkTrust

If your view is an advanced XML, you can manipulate the filtering options in the "Message" module of the view.

It looks a bit like this:

<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>

I don't have a good list of possible values for filter, but if your dashboard is pretty static and well-trusted, you could remove the Message module in its entirety. Another good option to look at is @sideview's approach in:

http://splunk-base.splunk.com/answers/3123/message-module-filter-values

If it is not an advanced XML view, then I don't know if this is even possible.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

If your view is an advanced XML, you can manipulate the filtering options in the "Message" module of the view.

It looks a bit like this:

<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>

I don't have a good list of possible values for filter, but if your dashboard is pretty static and well-trusted, you could remove the Message module in its entirety. Another good option to look at is @sideview's approach in:

http://splunk-base.splunk.com/answers/3123/message-module-filter-values

If it is not an advanced XML view, then I don't know if this is even possible.

dwaddle
SplunkTrust
SplunkTrust

Well, again, commenting it out is a drastic step - all warning and error messages won't show up.... maybe someone will have a better approach.

0 Karma

slierninja
Communicator

Commenting out the Message module worked perfectly! I questioned that, but I only know enough to be dangerous at this point. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...