Dashboards & Visualizations

"Your timerange was substituted based on your search string" in my custom dashboard

the_wolverine
Champion

I'm creating a custom dashboard and am seeing this unsightly notice. Is there an easy way to disable these? My users do not need to know that the "timerange was subsituted based on your search string."

Tags (1)
1 Solution

southeringtonp
Motivator

You should be able to suppress it by modifying the filter in the Message module, but I'm not sure how to do it in a targeted way.

This may do what you want, but will suppress too much...

<module name="Message" layoutPanel="messaging">
        <param name="filter">splunk.search.error</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
</module>

I've been trying to do basically the same thing but haven't seen a good, granular way to exclude a single message.

View solution in original post

wwhitener
Communicator

I had the same thing happen with me when we upgraded to 4.2.2 from 3.4.5. All of my saved searches were created in 3.4.5 and then spat out that "info" line.

I had to edit my saved searches, remove the startXXXago=99 (i.e. starthoursago=24 or startminsago=60) and put the time constraint in the drop down to the left/underneath. I then had to save it to the same query name.

The queries then gave me the answers without the INFO line. I suppose it was because of some kind of weirdness between versions?

0 Karma

newaccount
New Member

I'm lazy, but this will work; sends stderr to stdout and greps it away

/opt/splunk/bin/splunk search 'earliest=-5m' 2>&1|grep -v "INFO: Your timerange was substituted based on your search string"

0 Karma

southeringtonp
Motivator

You should be able to suppress it by modifying the filter in the Message module, but I'm not sure how to do it in a targeted way.

This may do what you want, but will suppress too much...

<module name="Message" layoutPanel="messaging">
        <param name="filter">splunk.search.error</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
</module>

I've been trying to do basically the same thing but haven't seen a good, granular way to exclude a single message.

the_wolverine
Champion

Good enough for me. Thank you!

0 Karma

southeringtonp
Motivator

Also, just discovered another old post along these lines - http://answers.splunk.com/questions/3123/message-module-filter-values

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...