Splunk: Disable real-time search (GH-#39)