Use field filters in searches

Field filters are a powerful tool that can help many organizations protect their sensitive fields from prying eyes, but field filters might not be a good fit for every deployment.

If your organization uses downstream configurations, such as accelerated data models, Splunk Enterprise Security (ES) detections using those data models, or user-level search-time field extractions, ensure you sufficiently plan for your field filter use cases on those configurations before deploying field filters in your environment. See READ THIS: Downstream impact of field filters.

If your organization runs Splunk Enterprise Security or if your users rely heavily on commands that field filters restrict by default, such as mpreview and mstats, do not use field filters in production until you have thoroughly planned how you will work around these restricted commands. See READ THIS: Restricted commands do not work in searches on indexes that have field filters.