Splunk Enterprise

Cannot hide child data model fields from Pivot users.

sh1pit76
Explorer

I'm running Splunk Enterprise Version 8.0.2.1 in a distributed environment with 3 search heads and 8 indexers. I've created a data model with child datasets for Pivot users, and I noticed two bugs.

First, while I can hide fields from Pivot users at the parent dataset level, I am not able to hide child fields. I can mark them as hidden if they are a child of a parent dataset, but when I actually go into the Pivot view, the fields still show up as optional Split by fields. 

Second, if I create a child beneath an existing child dataset (i.e., 3rd level child), and I mark its fields a hidden, their status in Splunk Web returns them to Shown as soon as I click away and return to the same settings in the Data Model editor.

Any thoughts, ideas, solutions?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...