Splunk Search

How to remove automatic real-time searches that run when users visit the Home page and Search app?

cramasta
Builder

I would like to remove the realtime searches that get kicked off automatically when a user is on the following pages

/en-US/app/launcher/home (Data Panel)
/en-US/app/search/search (What to Search Panel)

This is the search that gets kicked off if you visit those pages
| metadata type=sourcetypes | search totalCount > 0

Anyone know what edits need to be made and where need to stop them from happening?

Tags (2)
1 Solution

bpaul_splunk
Splunk Employee
Splunk Employee

In Splunk version 6.2 you may disable the real time searches by adding the following two lines to the ui-prefs.conf file.

display.prefs.enableMetaData=0
display.prefs.showDataSummary=0

View solution in original post

pellegrini
Path Finder

Edit the JavaScripts are no longer required.

If above solution does not solve it, you need to remove user specific config. See solution provided in Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not bein... 

0 Karma

bpaul_splunk
Splunk Employee
Splunk Employee

In Splunk version 6.2 you may disable the real time searches by adding the following two lines to the ui-prefs.conf file.

display.prefs.enableMetaData=0
display.prefs.showDataSummary=0

sherm77
Path Finder

This works perfectly, I just turned off the first one that disables the MetaData search, I retained the Data Summary button since some of my users utilize it.

0 Karma

twinspop
Influencer

This should be the default. Or at least a bolded "BEST PRACTICE" for anything more than a small single server installation.

0 Karma

ridwanahmed
Path Finder

Do these settings turn off ALL metadata searching? Or are these specifically for those searches in the landing page?

0 Karma

sudosplunk
Motivator

No. These settings disables metadata searches in the landing page ONLY.

jagadeeshm
Contributor

This setting doesn't seem to be working in 6.5.3.

0 Karma

sudosplunk
Motivator

It worked for me in 6.5.3. Please be sure to make the change under $SPLUNK_HOME/etc/system/local/ui-prefs.conf file. Changes made anywhere else will have low precedence.

0 Karma

the_wolverine
Champion

This answers thread should be considered an ER to remove or significantly modify these panels. RT search is a drain and customers can not afford to have to chase down users and/or spend time maintaining modifications to disable this "feature".

the_wolverine
Champion

We've been waiting on support for months for a hack to disable the JS and have been told that this "feature" will be configurable in version 6.2.

ltang_splunk
Splunk Employee
Splunk Employee

This is now currently configurable in 6.2. See answer below for configuration parameters in iu-prefs.conf.

0 Karma

jstacey_intuit
Explorer

Can someone from Splunk chime in here? This exhausts our pool of realtime searches that are made available almost instantly when all of our end users login.

martin_mueller
SplunkTrust
SplunkTrust

That's hardwired into the JavaScript. For example, the home page data panel's search is in $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/routers/Homepage.js, around line 400 in method startMetaDataSearch. Note - changes in there require rebuilding the compiled file $SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/build/homepage.js, won't survive an update, and won't be supported.

ltang_splunk
Splunk Employee
Splunk Employee

See configuration available in 6.2, details below.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...