What's the best way to preserve legitimate errors/warnings on a dashboard that uses |inputlookup
to populate dropdowns or other UI elements, while suppressing the following message:
Successfully read lookup file '/opt/splunk/etc/apps/appname/lookups/lookupfile.csv'
Is there a preferred value for the filter
parameter below that will suppress just that one message?
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
This was answered (as much as possible) in a couple of other threads:
http://answers.splunk.com/questions/3123/message-module-filter-values
This was answered (as much as possible) in a couple of other threads:
http://answers.splunk.com/questions/3123/message-module-filter-values