Is there a way to hide the splunk notification message:
[subsearch]: Your timerange was substituted based on your search string
I have a saved search that utilizes joins and each time I view the saved search in the dashboard it displays this notification in Splunk 4.2.
If your view is an advanced XML, you can manipulate the filtering options in the "Message" module of the view.
It looks a bit like this:
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
I don't have a good list of possible values for filter
, but if your dashboard is pretty static and well-trusted, you could remove the Message module in its entirety. Another good option to look at is @sideview's approach in:
http://splunk-base.splunk.com/answers/3123/message-module-filter-values
If it is not an advanced XML view, then I don't know if this is even possible.
If your view is an advanced XML, you can manipulate the filtering options in the "Message" module of the view.
It looks a bit like this:
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
I don't have a good list of possible values for filter
, but if your dashboard is pretty static and well-trusted, you could remove the Message module in its entirety. Another good option to look at is @sideview's approach in:
http://splunk-base.splunk.com/answers/3123/message-module-filter-values
If it is not an advanced XML view, then I don't know if this is even possible.
Well, again, commenting it out is a drastic step - all warning and error messages won't show up.... maybe someone will have a better approach.
Commenting out the Message
module worked perfectly! I questioned that, but I only know enough to be dangerous at this point. Thanks for the help!