topic Re: How to hide an entire field value in Splunk Search

How to hide an entire field value?

fatanyk — Tue, 11 Apr 2023 14:10:43 GMT

Hello,

I've an index where all my data is stored and I want to create 2 savedsearch :

- one with all the data (i have to create this one because there are others sourcetype that i don't want the user to access).

- one with less data

I have an issue when i create my savedsearch with

|table myfield1,myfield2

i can see myfield3 in the events tab from the search result.

In fact, i want to see myfield3 from events tab only with my savedsearch with all the data but not in the other one.

ITWhisperer — Tue, 11 Apr 2023 09:23:55 GMT

The events tab shows the events from the initial search, before any transformation such as removing a field from the output of the search.

Instead, you could use a summary index to store the depleted events.

gcusello — Tue, 11 Apr 2023 10:25:54 GMT

data access is controlled at index level, but you cannot give access to a user to a part of the index.

You can create dedicated dashboards that display only some fields, but you have also to block the access to the raw data (Open in search feature).

A good approach could be the one hinted by @ITWhisperer of creating a new Summary index with only a part of information for these users.

Ciao.

Giuseppe

fatanyk — Tue, 11 Apr 2023 12:13:25 GMT

I'll try to check that.

Thx

gcusello — Tue, 11 Apr 2023 12:33:02 GMT

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉