Splunk Search

Hide Interesting Fields?

andrewkenth
Communicator

Is it possible to hide certain fields from users based on roles or some other granularity?

I'm interested in giving my end users a very streamlined expereince and am interested in removing some of the redundant fields like date_*, splunk _server, timestartpos,timestartpos etc. I'm looking around at the documentation but I have not come across any capability or searched for the right string!

Thanks!

Tags (1)
1 Solution

somesoni2
Revered Legend

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

View solution in original post

0 Karma

somesoni2
Revered Legend

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

0 Karma

lguinn2
Legend

And you could remove the entire MultiFieldViewer module, along with its embedded SuggestedFieldViewer, and I believe the view would still work properly.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...