How to hide an entire field value?

[fatanyk]

Hello,

I've an index where all my data is stored and I want to create 2 savedsearch : 

- one with all the data (i have to create this one because there are others sourcetype that i don't want the user to access).

- one with less data

I have an issue when i create my savedsearch with 

|table myfield1,myfield2

 i can see myfield3 in the events tab from the search result.

In fact, i want to see myfield3 from events tab only with my savedsearch with all the data but not in the other one.

[gcusello · Accepted solution]

Hi @ITWhisperer,

data access is controlled at index level, but you cannot give access to a user to a part of the index.

You can create dedicated dashboards that display only some fields, but you have also to block the access to the raw data (Open in search feature).

A good approach could be the one hinted by  @ITWhisperer of creating a new Summary index with only a part of information for these users.

Ciao.

Giuseppe

[fatanyk]

I'll try to check that.

Thx

[gcusello]

Hi @fatanyk,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[ITWhisperer]

The events tab shows the events from the initial search, before any transformation such as removing a field from the output of the search.

Instead, you could use a summary index to store the depleted events.