Splunk Search

Stop displaying aliased fields

lguinn2
Legend

I have aliased a field (let's call it application_auth_id) to a new name (user). I want my Splunk users to search using user - not the old name, application_auth_id. Unfortunately, application_auth_id shows up near the top of the interesting fields list, and it confuses the users.

How can I remove a field (application_auth_id) from the fields sidebar?

Tags (1)

lguinn2
Legend

As best I can tell, you can customize nothing about the Search app's look and feel in Splunk 6. 😞

In Splunk 5, custom versions of the flashtimeline and dashboard_live were pretty common.

0 Karma

aelliott
Motivator

Is this along the lines of what you are looking for?
http://answers.splunk.com/answers/110886/hide-interesting-fields

lguinn2
Legend

Doesn't work in Splunk 6

probably worked in Splunk 5...

Thanks!

0 Karma

lguinn2
Legend

Thanks - I had searched for this, but didn't find it! I will try this and see if it works!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...