Splunk Search

timepicker and real time

albertohontoria
Path Finder

Hi friends

I am using timepicker to select a time range, and pass it to dbquery command to search the database.

But the timepicker is showing realtime menu, which is not compatible with dbquery. I want to disable it. Splunk 6.0.1

I have tried the documentation
[real_time_menu]
disabled = 1

and also

[real_time_menu]
disabled = true

with no sucess. In this version is there another way to disable it?

I also want to disable Advanced menu in datepicker.

Thanks in advance

Tags (2)

DaveAW
Engager

This can be done using CSS - either within a css file in your app's static folder that is referenced by your dashboard xml, or within dashboard.css to apply across all dashboards.

/* Hide Real-time Options (Splunk 6.4.1) */
.shared-timerangepicker-dialog div.accordion-group:nth-child(3),
.shared-timerangepicker-dialog-presets .presets-group:first-child,
.shared-timerangepicker-dialog-presets .presets-divider-wrap:first-child
{   
    display: none !important; 
}

Rocket66
Communicator

Yes! That's more robust and versatile!

0 Karma

Rocket66
Communicator

The easy way ist to hide that section with CSS 🙂
Each section (Real-time, realtive, datetime, ... ) has a DOM-ID

Hide that ID with an CSS :

[hash]realtime_view6562 {
display: none;
}

the number (6562) behind "realtime_view" is dynamic - it depends on your dashbaord - you have to find it out with DOM-Tools - like "firebug" (Mozilla FF) 🙂

0 Karma

srinathd
Contributor

is the DOM-ID will always be the same for advanced menu. There are so many dashboards, it will be difficult to do for all dashboards.. is there any generic way of doing it..

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I am too not able to accomplish this in Splunk 6.0.1. I even tried deleting the Realtime entries (all of them) from etc/system/default/times.conf (after creating a backup and restarted splunk).

aelliott
Motivator

This is the only way I found to disable realtime searches. The real_time_menu was not in the documentation that I could see (but did see it in splunk answers)
http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Restrictrealtimesearch

I also found someone else who was trying to do this as well:
http://answers.splunk.com/answers/88356/remove-real-time-from-dashboard-panel

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...