Splunk Search

timepicker and real time

Path Finder

Hi friends

I am using timepicker to select a time range, and pass it to dbquery command to search the database.

But the timepicker is showing realtime menu, which is not compatible with dbquery. I want to disable it. Splunk 6.0.1

I have tried the documentation
disabled = 1

and also

disabled = true

with no sucess. In this version is there another way to disable it?

I also want to disable Advanced menu in datepicker.

Thanks in advance

Tags (2)


This can be done using CSS - either within a css file in your app's static folder that is referenced by your dashboard xml, or within dashboard.css to apply across all dashboards.

/* Hide Real-time Options (Splunk 6.4.1) */
.shared-timerangepicker-dialog div.accordion-group:nth-child(3),
.shared-timerangepicker-dialog-presets .presets-group:first-child,
.shared-timerangepicker-dialog-presets .presets-divider-wrap:first-child
    display: none !important; 


Yes! That's more robust and versatile!

0 Karma


The easy way ist to hide that section with CSS 🙂
Each section (Real-time, realtive, datetime, ... ) has a DOM-ID

Hide that ID with an CSS :

[hash]realtime_view6562 {
display: none;

the number (6562) behind "realtime_view" is dynamic - it depends on your dashbaord - you have to find it out with DOM-Tools - like "firebug" (Mozilla FF) 🙂

0 Karma


is the DOM-ID will always be the same for advanced menu. There are so many dashboards, it will be difficult to do for all dashboards.. is there any generic way of doing it..

0 Karma

Revered Legend

I am too not able to accomplish this in Splunk 6.0.1. I even tried deleting the Realtime entries (all of them) from etc/system/default/times.conf (after creating a backup and restarted splunk).


This is the only way I found to disable realtime searches. The real_time_menu was not in the documentation that I could see (but did see it in splunk answers)

I also found someone else who was trying to do this as well: