Knowledge Management

How to disable or hide an old field name when selecting "Add Auto-Extracted Field" for a data model?

pgadhari
Builder

Hi All,

We have created a data model with root object. In our data, we have the fields in our CSV which have "space" in the headers like "FY16 data", "FY17 data" and so on.. now what we have done is we have created the alias for these fields and named it as "FY16_data", "FY17_data". Now when we are doing the auto extraction for the attributes in the root object, it is showing both the fieldnames with "space" as well as _. I don't want to show the fieldnames with "space" when I do "Add Auto-Extracted Field" . Is there a way to disable or hide the old fieldnames that have "space" in their header ?

Thanks
PG

0 Karma

sundareshr
Legend

The fields that show in the data model are only the ones you select. So, even if it shows in the autoextract list, if you don't select it, it will not be included in the data model.

0 Karma

pgadhari
Builder

Yes I know that unless I select the field it will not show. But still I want that those old fields shud not show up in the auto extract list also ? Can it be done ? Is it possible to use fields.conf for that ? Pls advise.

0 Karma

ryanoconnor
Builder

That loos like it is an extracted field or Aliased field. Have you looked to see if you have any field extractions or aliases setup for "Approval Date"? You should be able to modify or delete those if you do

0 Karma

woodcock
Esteemed Legend

Add this:

 | fields - "* *"
0 Karma

pgadhari
Builder

where should I add the above command "| fields - "* *", as I told you I am not using any splunk query here. Hope you are getting my question ? Can you let me know how can i use it in the datamodel root event object ?

0 Karma

woodcock
Esteemed Legend

I do not know of any way to do this.

0 Karma

pgadhari
Builder

Hi Woodcock,

I am not using queries here, hence dont want to use fields command. See the below image, I want to remove that field which as "space" in between permanently from the root event object in data model.

alt text

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...