At the end of the day, Devo is about data reduction. Devo helps user focus on the data they need, to find the needle in the haystack. There are certainly several approaches towards data reduction. Oftentimes, data is reduced as a result of operations, but we can also hide irrelevant information from the UI with very simple steps. Let’s see it!
Some data tables contain a very large number of fields and often, we don’t need to use the data contained in these fields. This is when it’s useful to hide fields so that we can focus on the data that really interests us.
One of the analysts at Arcadia wants to work with the firewall.juniper.ssg.traffic table but doesn’t need to use the data in most of the fields.
Show her how she can hide all of the fields except eventdate, machine, srcIp, dstIp, srcPort, and dstPort before she even opens the firewall.juniper.ssg.traffic table.
it is possible to do this both from the finder and also from the search window. However, the result is not exactly the same.
Are you able to identify both methods? What’s the difference between them?
- If you hide fields from the finder, you won’t be able to make them reapper once in the search window by clicking on the field manager. However, you might still call them in operations or by entering a LINQ operation directly. Note how hiding fields with this method adds some LINQ statements in the query code editor.
- If you enter the table as normal from the finder and then hide fields by using the field manager, they are hidden from view but you can enable them back by opening the field manager again.
