Is there a way to remove the realtime search option from my dropdown time picker.
example of code:
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<default>
<earliestTime>-24h@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
<input type="dropdown" token="time_span">
<label>Time Span:</label>
<choice value="5m">5m</choice>
<default>5m</default>
</input>
</fieldset>
Example of time-picker: Is there a way to remove the Real-time
part that appears from the drop down time picker(highlighted in red)?
EDIT1 - This is the html code(when I do an inspect element on the dropdown) for the "Real-time" part of my pic above(The bit highlight in red). This is what I would like to remove, and as suggessted below, maybe css is the way to do it. Just not sure of the css to remove it.
<div class="accordion-inner presets-container shared-timerangepicker-dialog-presets" data-cid="view112564" data-view="views/shared/timerangepicker/dialog/Presets" data-render-time="0.002">
<ul class="unstyled presets-group">
<li>Real-time</li>
<li><a href="#" data-earliest="rt-30s" data-latest="rt">30 second window</a></li>
<li><a href="#" data-earliest="rt-1m" data-latest="rt">1 minute window</a></li>
<li><a href="#" data-earliest="rt-5m" data-latest="rt">5 minute window</a></li>
<li><a href="#" data-earliest="rt-30m" data-latest="rt">30 minute window</a></li>
<li><a href="#" data-earliest="rt-1h" data-latest="rt">1 hour window</a></li>
<li><a href="#" data-earliest="rt" data-latest="rt">All time (real-time)</a></li>
</ul>
<div class="presets-divider-wrap">
<div class="presets-divider"></div></div>
<ul class="unstyled presets-group">
<li>Relative</li>
...
Thanks for all the notes here and I finally figured it out... Basically we have to set display:none to all the div that is used by the real-time search criteria. I used the inspector to find the div element and the associated string that is used to match in the CSS stylesheet.
Here's the example of what I did, and as Splunk updates their software this might change in the future too:
When viewing source of the time picker, this is the code:
<fieldset submitButton="false">
<input type="time" token="timefield" searchWhenChanged="true">
<label>Please enter a timeframe</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<!-- Added to remove real-time column and panel -->
<html>
<style>
div[data-test="real-time-column"] {
display: none;
}
div[data-test-panel-id="realTime"] {
display: none;
}
</style>
</html>
<!-- End manual modification -->
</fieldset>
I just realized I gave the same answer and you had the solution I came up with too.
Is there a way to hide accordions from first time picker and show everything from the second time picker.
Hi HattrickNZ,
you can hide the real-time presets using this css:
/* hide real-time accordion */
div[id^='realtime_view'] {
display: none;
}
/* hide real-time presets */
div[id^='presets_view'] > div.accordion-body > div > ul:nth-child(1) {
display:none;
}
/* hide divider after real-time presets */
div[id^='presets_view'] > div.accordion-body > div > div:nth-child(2) {
display:none;
}
Put it in your app directory in app server/static
and use it in the dash board with stylesheet="yourcssfilenamehere.css"
, depending on your Splunk version you can either restart Splunkweb or _bump
it by accessing this URL http[s]?://<SPLUNK_IP_ADDRESS>:8000/en-GB/_bump
.
After that the real-time presets are hidden:
But one can still used them with the advanced options in the time range picker, so you additionally need to remove the rtsearch
capabilities from the user role to make sure user don't run a manual real-time search.
Hope this helps ...
cheers, MuS
@MuS- where is the location of this HTML/CSS file with the date/time options?
Hi there,
nowadays this can be configured in the Splunk UI under `Settings - User Interface - Time Ranges`
cheers, MuS
can I put the css in the xml code like @paramagurukarthikeyan mentions below? That would be the ideal.
It fails for me when trying inline....
If you want, You can do it using a simple css fix
If you are using simple xml. Add a html module like below,
<form onUnloadCancelJobs="True">
<label>test_css</label>
<row>
<panel>
<input type="time" token="field1" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<html>
<style>
/* This is to remove the "All Time (Real Time)" under "Preset"*/
.presets-group a[data-earliest="rt"] {
display: none;
}
</style>
</html>
</panel>
</row>
</form>
Add it to the end of last panel so that you can avoid unwanted padding/margin spaced added by html module
This doesn't work, at least in version 7
tks, css is the kind of solution I am looking for but I could not get this to work but see my edit1, I have included the html code, in the Question. As maybe the css can be slightly edited to work on that html?
Sorry I missed the trailing comment char (*/) in my css
Please see the updated complete xml in my answer
you can try to add a user role and do not give
rtsearch and schedule_rtsearch
else you can also go and edit authorize.conf to create a role. Please check the below sample role
[role_limited_user]
change_own_password = enabled
embed_report = enabled
get_metadata = enabled
get_typeahead = enabled
input_file = enabled
list_deployment_client = enabled
list_forwarders = enabled
list_inputs = enabled
output_file = enabled
request_remote_tok = enabled
rest_apps_view = enabled
rest_properties_get = enabled
run_debug_commands = enabled
search = enabled
schedule_search = enabled
srchTimeWin = 1209600
tks but would like to do it in the simple xml if possible.