Refine your search:

In the Deployment Monitor App, on the main dashboard there is the Index Throughput graph - which runs the "DM indexthru today vs last week" saved search.

When you view the dashboard, there are no time range messages. I copied the dashboard's XML & search, and substituted my own search values (the search is essentially the same). When I run it, however, I get the following message: "[subsearch]: Your timerange was substituted based on your search string".

If I modify the XMl to have this:

<module name="Message" layoutpanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">0</param> </module>

Then the error message goes away, but I think this will suppress all error messages. My question then is this - Why does your search not show the time range message, but mine does?

asked 13 Sep '11, 11:01

sf_user_199's gravatar image

sf_user_199
884
accept rate: 66%


One Answer:

This code serves pretty well. I believe the Deployment Monitor app uses the same thing or something very similar. Paste this into /etc/apps/<appname>/appserver/static/application.js. You may have to create the file if the given app doesn't have one already, and you have to do it in every app that you need the suppression in.

/**
 * Customize the message module so it wont constantly be telling the user that
 * lookup tables have been loaded and written to.
 * Unfortunately this is the least evil way I was able to find to
 * override the message handling.
 */
if (Splunk.Module.Message) {
    Splunk.Module.Message= $.klass(Splunk.Module.Message, {
        getHTMLTransform: function($super){
            // Please dont tell me any 'info' about lookups, nor 'error' about entityLabelSingular, etc...
            // Thank you that is all.
            var argh = [
                {contains:"lookup", level:"info"},
                {contains:"Results written to", level:"info"},
                {contains:"entityLabelSingular", level:"error"},
                {contains:"auto-finalized", level:"info"},
                {contains:"Your timerange was substituted", level:"info"},
                {contains:"Specified field(s) missing from results", level:"warn"}
            ];
            for (var i=0,len=this.messages.length; i<len; i++){
                var message = this.messages[i];
                for (var j=0,jLen=argh.length;j<jLen;j++) {
                    if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {

                        this.messages.splice(i,1);
                        break;
                    }
                }
            }
            return $super();
        }
    });
}
link

answered 20 Sep '11, 19:04

nick's gravatar image

nick ♦
14.2k1318
accept rate: 47%

edited 20 Sep '11, 19:06

Nick, this code snippet produces the following error in web_service.log: 2011-11-11 14:18:34,698 ERROR [4ebd9f3ab11bb1aa90] utility:63 - name=javascript, class=Splunk.Error, lineNumber=54, message=this.messages is undefined, fileName=<pathtoapp>/application.js

(11 Nov '11, 14:23) Archana

Per araitz, use this.diplayedMessages instead of this.messages

(11 Nov '11, 14:35) Archana

Well in 4.2.3 it's this.messages, and there is no this.displayedMessages anywhere as far as I can tell. So I guess you're saying that you're working on the newer version and someone has changed the Message module enough where the patch doesn't work. In that case there may be more than that one problem fwiw.

(11 Nov '11, 14:42) nick ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×325
×161

Asked: 13 Sep '11, 11:01

Seen: 473 times

Last updated: 11 Nov '11, 14:42

Copyright © 2005-2012 Splunk, Inc. All rights reserved.