Splunk Search

timepicker and real time

Path Finder

Hi friends

I am using timepicker to select a time range, and pass it to dbquery command to search the database.

But the timepicker is showing realtime menu, which is not compatible with dbquery. I want to disable it. Splunk 6.0.1

I have tried the documentation
[real_time_menu]
disabled = 1

and also

[real_time_menu]
disabled = true

with no sucess. In this version is there another way to disable it?

I also want to disable Advanced menu in datepicker.

Thanks in advance

Tags (2)

Engager

This can be done using CSS - either within a css file in your app's static folder that is referenced by your dashboard xml, or within dashboard.css to apply across all dashboards.

/* Hide Real-time Options (Splunk 6.4.1) */
.shared-timerangepicker-dialog div.accordion-group:nth-child(3),
.shared-timerangepicker-dialog-presets .presets-group:first-child,
.shared-timerangepicker-dialog-presets .presets-divider-wrap:first-child
{   
    display: none !important; 
}

Communicator

Yes! That's more robust and versatile!

0 Karma

Communicator

The easy way ist to hide that section with CSS 🙂
Each section (Real-time, realtive, datetime, ... ) has a DOM-ID

Hide that ID with an CSS :

[hash]realtime_view6562 {
display: none;
}

the number (6562) behind "realtime_view" is dynamic - it depends on your dashbaord - you have to find it out with DOM-Tools - like "firebug" (Mozilla FF) 🙂

0 Karma

Contributor

is the DOM-ID will always be the same for advanced menu. There are so many dashboards, it will be difficult to do for all dashboards.. is there any generic way of doing it..

0 Karma

Revered Legend

I am too not able to accomplish this in Splunk 6.0.1. I even tried deleting the Realtime entries (all of them) from etc/system/default/times.conf (after creating a backup and restarted splunk).

Motivator

This is the only way I found to disable realtime searches. The real_time_menu was not in the documentation that I could see (but did see it in splunk answers)
http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Restrictrealtimesearch

I also found someone else who was trying to do this as well:
http://answers.splunk.com/answers/88356/remove-real-time-from-dashboard-panel

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!