How to disable or hide an old field name when selecting "Add Auto-Extracted Field" for a data model?

[pgadhari]

Hi All,

We have created a data model with root object. In our data, we have the fields in our CSV which have "space" in the headers like "FY16 data", "FY17 data" and so on.. now what we have done is we have created the alias for these fields and named it as "FY16_data", "FY17_data". Now when we are doing the auto extraction for the attributes in the root object, it is showing both the fieldnames with "space" as well as _. I don't want to show the fieldnames with "space" when I do "Add Auto-Extracted Field" . Is there a way to disable or hide the old fieldnames that have "space" in their header ?

Thanks
PG

[sundareshr]

The fields that show in the data model are only the ones you select. So, even if it shows in the autoextract list, if you don't select it, it will not be included in the data model.

[pgadhari]

Yes I know that unless I select the field it will not show. But still I want that those old fields shud not show up in the auto extract list also ? Can it be done ? Is it possible to use fields.conf for that ? Pls advise.

[ryanoconnor]

That loos like it is an extracted field or Aliased field. Have you looked to see if you have any field extractions or aliases setup for "Approval Date"? You should be able to modify or delete those if you do

[woodcock]

Add this:

 | fields - "* *"

[pgadhari]

where should I add the above command "| fields - "* *", as I told you I am not using any splunk query here. Hope you are getting my question ? Can you let me know how can i use it in the datamodel root event object ?

[woodcock]

I do not know of any way to do this.

[pgadhari]

Hi Woodcock,

I am not using queries here, hence dont want to use fields command. See the below image, I want to remove that field which as "space" in between permanently from the root event object in data model.