"Your timerange was substituted based on your search string" in my custom dashboard

Question

I'm creating a custom dashboard and am seeing this unsightly notice. Is there an easy way to disable these? My users do not need to know that the "timerange was subsituted based on your search string."

Accepted Answer

3

You should be able to suppress it by modifying the filter in the Message module, but I'm not sure how to do it in a targeted way.

This may do what you want, but will suppress too much...

<module name="Message" layoutPanel="messaging">
        <param name="filter">splunk.search.error</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
</module>

I've been trying to do basically the same thing but haven't seen a good, granular way to exclude a single message.

link

answered 02 Sep '10, 18:14

southeringtonp ♦
4.5k●1●2●15
accept rate: 35%

edited 02 Sep '10, 18:46

Also, just discovered another old post along these lines - http://answers.splunk.com/questions/3123/message-module-filter-values

(03 Sep '10, 01:59) southeringtonp ♦

Good enough for me. Thank you!

(03 Sep '10, 17:47) the_wolverine ♦

Answer 2

0	I'm lazy, but this will work; sends stderr to stdout and greps it away /opt/splunk/bin/splunk search 'earliest=-5m' 2>&1\|grep -v "INFO: Your timerange was substituted based on your search string" link answered 23 Nov '11, 13:07 newaccount 11 accept rate: 0%

Answer 3

I had the same thing happen with me when we upgraded to 4.2.2 from 3.4.5. All of my saved searches were created in 3.4.5 and then spat out that "info" line.

I had to edit my saved searches, remove the startXXXago=99 (i.e. starthoursago=24 or startminsago=60) and put the time constraint in the drop down to the left/underneath. I then had to save it to the same query name.

The queries then gave me the answers without the INFO line. I suppose it was because of some kind of weirdness between versions?

"Your timerange was substituted based on your search string" in my custom dashboard

Follow this question

Splunk Resources

Related questions