Splunk Search

Hide Interesting Fields?

andrewkenth
Communicator

Is it possible to hide certain fields from users based on roles or some other granularity?

I'm interested in giving my end users a very streamlined expereince and am interested in removing some of the redundant fields like date_*, splunk _server, timestartpos,timestartpos etc. I'm looking around at the documentation but I have not come across any capability or searched for the right string!

Thanks!

Tags (1)
1 Solution

somesoni2
Revered Legend

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

View solution in original post

0 Karma

somesoni2
Revered Legend

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

0 Karma

lguinn2
Legend

And you could remove the entire MultiFieldViewer module, along with its embedded SuggestedFieldViewer, and I believe the view would still work properly.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...