Supress Subsearch Warning

[slierninja]

Is there a way to hide the splunk notification message:

[subsearch]: Your timerange was substituted based on your search string

I have a saved search that utilizes joins and each time I view the saved search in the dashboard it displays this notification in Splunk 4.2.

[dwaddle · Accepted solution]

If your view is an advanced XML, you can manipulate the filtering options in the "Message" module of the view.

It looks a bit like this:

<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>

I don't have a good list of possible values for filter, but if your dashboard is pretty static and well-trusted, you could remove the Message module in its entirety. Another good option to look at is @sideview's approach in:

http://splunk-base.splunk.com/answers/3123/message-module-filter-values

If it is not an advanced XML view, then I don't know if this is even possible.

[dwaddle]

Well, again, commenting it out is a drastic step - all warning and error messages won't show up.... maybe someone will have a better approach.

[slierninja]

Commenting out the Message module worked perfectly! I questioned that, but I only know enough to be dangerous at this point. Thanks for the help!