Splunk Search

Supress Subsearch Warning

Communicator

Is there a way to hide the splunk notification message:

[subsearch]: Your timerange was substituted based on your search string

I have a saved search that utilizes joins and each time I view the saved search in the dashboard it displays this notification in Splunk 4.2.

1 Solution

SplunkTrust
SplunkTrust

If your view is an advanced XML, you can manipulate the filtering options in the "Message" module of the view.

It looks a bit like this:

<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>

I don't have a good list of possible values for filter, but if your dashboard is pretty static and well-trusted, you could remove the Message module in its entirety. Another good option to look at is @sideview's approach in:

http://splunk-base.splunk.com/answers/3123/message-module-filter-values

If it is not an advanced XML view, then I don't know if this is even possible.

View solution in original post

SplunkTrust
SplunkTrust

If your view is an advanced XML, you can manipulate the filtering options in the "Message" module of the view.

It looks a bit like this:

<module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
</module>

I don't have a good list of possible values for filter, but if your dashboard is pretty static and well-trusted, you could remove the Message module in its entirety. Another good option to look at is @sideview's approach in:

http://splunk-base.splunk.com/answers/3123/message-module-filter-values

If it is not an advanced XML view, then I don't know if this is even possible.

View solution in original post

SplunkTrust
SplunkTrust

Well, again, commenting it out is a drastic step - all warning and error messages won't show up.... maybe someone will have a better approach.

0 Karma

Communicator

Commenting out the Message module worked perfectly! I questioned that, but I only know enough to be dangerous at this point. Thanks for the help!

0 Karma