Splunk Enterprise

Cannot hide child data model fields from Pivot users.


I'm running Splunk Enterprise Version in a distributed environment with 3 search heads and 8 indexers. I've created a data model with child datasets for Pivot users, and I noticed two bugs.

First, while I can hide fields from Pivot users at the parent dataset level, I am not able to hide child fields. I can mark them as hidden if they are a child of a parent dataset, but when I actually go into the Pivot view, the fields still show up as optional Split by fields. 

Second, if I create a child beneath an existing child dataset (i.e., 3rd level child), and I mark its fields a hidden, their status in Splunk Web returns them to Shown as soon as I click away and return to the same settings in the Data Model editor.

Any thoughts, ideas, solutions?

Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.