Wednesday, January 21, 2015

no more 500MB limit message in splunk free...
 /opt/splunk/share/splunk/search_oxiclean/static/core/application  
   
 append at end of file application.js :  
   
   
 if (Splunk.Module.Message) {  
   Splunk.Module.Message= $.klass(Splunk.Module.Message, {  
     getHTMLTransform: function($super){  
       // Ignore the following message(s)  
       var argh = [  
         {contains:"Search scheduler is disabled in Splunk Free", level:"info"},  
       ];  
       for (var i=0,len=this.messages.length; i<len; i++){  
         var message = this.messages[i];  
         for (var j=0,jLen=argh.length;j<jLen;j++) {  
           if ((message.content.indexOf(argh[j]["contains"])!=-1) && (message.level == argh[j]["level"])) {  
             this.messages.splice(i,1);  
             break;  
           }  
         }  
       }  
       return $super();  
     }  
   });  
 }  

No comments: