Filtered and original field values in summary indexes
If you use field filters to protect sensitive fields in DMA searches, original unfiltered values might still exist in the accelerated data model summary and corresponding summary .tsidx files if the summary was built before the field filter was applied, or if the acceleration search ran with a role that was exempt from the field filter.
Search-time field filtering for tstats can protect non-exempt users from seeing those original values in search results. However, search-time filtering does not remove original values from summary files on disk.
To remove unfiltered values from a summary, you can either wait for Splunk software to automatically rebuild or age out the summary index for the accelerated data model according to the configured schedule, or manually rebuild the accelerated data model summary index after configuring field filters so they apply during summary generation. Manual rebuilds can be resource-intensive and might affect the performance of other running processes.
If users run tstats searches with summariesonly=f, test both the summary portion and any raw-data fallback behavior. Field filters apply according to the fields and role exemptions configured for each path.
For instructions about rebuilding an accelerated data model summary index, see Manage data model acceleration.