Reporting

Is there a limit to the number of fields that can be exported?

sfmandmdev
Path Finder

I am trying to export a search result that contains > 500 fields. This causes an "webpage is not found. Error 6 (net::ERR_FILE_NOT_FOND): The file or directory could not be found." If I pipe the results to fields, then I get able to successfully export the results. It appears that I am hitting some limit on the max number of fields allowed for export.

Is there a limit on the number of fields that can be exported? If yes, how can this limit be overridden?

Tags (3)
0 Karma

jrodman
Splunk Employee
Splunk Employee

Most likely this is one of a category of problems where the URL generated by the browser to splunkweb, or by splunkweb to splunkd is too large to work. We've fixed some related issues in the 4.1.5 to 4.2 stretch, so depending upon specifics it might work in a later revision.

In short, that's a bug not a configuration.

A dumb workaround might be to use |outputcsv in your search, and then go fetch the file out of the dispatch directory on the splunk server. Obviously thats not a scalable solution, but perhaps it gets you out of a bind for the moment.

Currently, the only good path for customers to report bugs is via support. Please do so, especially with some hints as to what the set of fields looks like. I'm suspicous that it has to do partly with field name length as well as quantity. IF you can show it cuts off at exactly 500 no matter what, that is useful info!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...