Splunk Search

Hide Interesting Fields?

andrewkenth
Communicator

Is it possible to hide certain fields from users based on roles or some other granularity?

I'm interested in giving my end users a very streamlined expereince and am interested in removing some of the redundant fields like date_*, splunk _server, timestartpos,timestartpos etc. I'm looking around at the documentation but I have not come across any capability or searched for the right string!

Thanks!

Tags (1)
1 Solution

somesoni2
Revered Legend

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

View solution in original post

0 Karma

somesoni2
Revered Legend

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

0 Karma

lguinn2
Legend

And you could remove the entire MultiFieldViewer module, along with its embedded SuggestedFieldViewer, and I believe the view would still work properly.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...