I'm running Splunk Enterprise Version 8.0.2.1 in a distributed environment with 3 search heads and 8 indexers. I've created a data model with child datasets for Pivot users, and I noticed two bugs.
First, while I can hide fields from Pivot users at the parent dataset level, I am not able to hide child fields. I can mark them as hidden if they are a child of a parent dataset, but when I actually go into the Pivot view, the fields still show up as optional Split by fields.
Second, if I create a child beneath an existing child dataset (i.e., 3rd level child), and I mark its fields a hidden, their status in Splunk Web returns them to Shown as soon as I click away and return to the same settings in the Data Model editor.
Any thoughts, ideas, solutions?
