Splunk Search

Hide Interesting Fields?

andrewkenth
Communicator

Is it possible to hide certain fields from users based on roles or some other granularity?

I'm interested in giving my end users a very streamlined expereince and am interested in removing some of the redundant fields like date_*, splunk _server, timestartpos,timestartpos etc. I'm looking around at the documentation but I have not come across any capability or searched for the right string!

Thanks!

Tags (1)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In the xml for the flashtimeline, at the bottom you have following entries

> ..... <module> name="MultiFieldViewer">
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>               <module name="SuggestedFieldViewer">
>                 <param name="minDistinctCount">1</param>
>                 <param name="minFrequency">0.5</param>
>                 <param name="maxFields">50</param>
>                 <param name="exclude">
>                   <list>^date_.*</list>
>                 </param>
>                 <param name="link">
>                   <param name="view">report_builder_format_report</param>
>                 </param>
>               </module>
>             </module>
>     .....

The module "MultiFieldViewer" is the field that you want to updated and how to restrict certain fields, example is given as part of "SuggestedFieldViewer" itself. Hope this helps.

0 Karma

lguinn2
Legend

And you could remove the entire MultiFieldViewer module, along with its embedded SuggestedFieldViewer, and I believe the view would still work properly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...