Splunk Enterprise

Cannot hide child data model fields from Pivot users.

sh1pit76
Explorer

I'm running Splunk Enterprise Version 8.0.2.1 in a distributed environment with 3 search heads and 8 indexers. I've created a data model with child datasets for Pivot users, and I noticed two bugs.

First, while I can hide fields from Pivot users at the parent dataset level, I am not able to hide child fields. I can mark them as hidden if they are a child of a parent dataset, but when I actually go into the Pivot view, the fields still show up as optional Split by fields. 

Second, if I create a child beneath an existing child dataset (i.e., 3rd level child), and I mark its fields a hidden, their status in Splunk Web returns them to Shown as soon as I click away and return to the same settings in the Data Model editor.

Any thoughts, ideas, solutions?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...