topic Hide Interesting Fields? in Splunk Search

Hide Interesting Fields?

andrewkenth — Wed, 13 Nov 2013 19:29:20 GMT

Is it possible to hide certain fields from users based on roles or some other granularity?

I'm interested in giving my end users a very streamlined expereince and am interested in removing some of the redundant fields like date_*, splunk _server, timestartpos,timestartpos etc. I'm looking around at the documentation but I have not come across any capability or searched for the right string!

Thanks!

Re: Hide Interesting Fields?

somesoni2 — Wed, 13 Nov 2013 23:12:05 GMT

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

Re: Hide Interesting Fields?

lguinn2 — Thu, 14 Nov 2013 06:42:21 GMT

And you could remove the entire MultiFieldViewer module, along with its embedded SuggestedFieldViewer, and I believe the view would still work properly.