Suppress lookup table alert in Message module

Question

What's the best way to preserve legitimate errors/warnings on a dashboard that uses |inputlookup to populate dropdowns or other UI elements, while suppressing the following message:

Successfully read lookup file '/opt/splunk/etc/apps/appname/lookups/lookupfile.csv'

Is there a preferred value for the filter parameter below that will suppress just that one message?

    <module name="Message" layoutPanel="messaging">
            <param name="filter">*</param>
            <param name="clearOnJobDispatch">False</param>
            <param name="maxSize">1</param>
    </module>

Accepted Answer

0

This was answered (as much as possible) in a couple of other threads:

http://answers.splunk.com/questions/6372/your-timerange-was-substituted-based-on-your-search-string-in-my-custom-dashboa/6375#6375

http://answers.splunk.com/questions/3123/message-module-filter-values

link

answered 03 Sep '10, 21:02

southeringtonp ♦
4.5k●1●2●15
accept rate: 35%

Suppress lookup table alert in Message module

Follow this question

Splunk Resources

Related questions