Splunk Search

Suppress search inspector?

smisplunk
Path Finder

If a search returns no results, the chart views will show "No results found" and will provide a mouse-over link to the search inspector. I'd like to suppress that for certain views. Is there an easy way to turn off the "More info..." link that is generated in these cases?

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

You cant show or suppress the link by role, but you can hide it completely in those views by putting a little custom CSS into your app.

here's some general docs about custom CSS http://www.splunk.com/base/Documentation/latest/Developer/UseCSS

Create a file, call it whatever you like but put it in /etc/apps/<appname>/appserver/static/ And put the following lines inside it:

.resultStatusHelp { 
  display:none;
}

Then for each of those embedded views, put a stylesheet attribute into the top level tag (in this case the top level tag will be the <view> tag, in simplified XML it'd be in <form> or <dashboard>). assuming your file is appserver/static/custom.css, you'd put stylesheet="custom.css".

View solution in original post

sideview
SplunkTrust
SplunkTrust

You cant show or suppress the link by role, but you can hide it completely in those views by putting a little custom CSS into your app.

here's some general docs about custom CSS http://www.splunk.com/base/Documentation/latest/Developer/UseCSS

Create a file, call it whatever you like but put it in /etc/apps/<appname>/appserver/static/ And put the following lines inside it:

.resultStatusHelp { 
  display:none;
}

Then for each of those embedded views, put a stylesheet attribute into the top level tag (in this case the top level tag will be the <view> tag, in simplified XML it'd be in <form> or <dashboard>). assuming your file is appserver/static/custom.css, you'd put stylesheet="custom.css".

Johnvey
Contributor

No, that functionality is built into the default panels. Is there a specific reason why you want to disable that link? Is there content on the inspection page that you don't want to expose?

smisplunk
Path Finder

In short, yes. We're utilizing SSO to link directly to some Splunk views (iFrame), and wish to obfuscate the direct URL of Splunk for a certain class (role) of user. Is there something in the roles that would disallow the search inspector popup?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...