Is there a limit on the number of selected or interesting fields in Splunk?

[Kukkadapu]

Hi,

I have a log statement with almost 100 fields. When searched, it doesn't show all the fields in Selected fields nor in All fields tab. Is there a limitation for the number of fields in Splunk? If so, where do I change it?

I used the table command to make sure the missing fields are there, it's just not showing in the panel to the left.

Thanks.

[jkat54]

The select fields menu filters by events with greater than 1% match by default. Did you change that?

[sgadde]

Check the answer by veganjay here: https://answers.splunk.com/answers/129773/advice-for-when-you-have-more-than-100-automatically-extra...
It worked for me.

[Kukkadapu]

Jkat54, I've the same settings. The coverage is 1% or more.

[jkat54]

Change it to All Fields.

[jkat54]

Also be sure you're searching in verbose mode.

[Kukkadapu]

Yes, I tried it , but no luck. It doesn't show all the fields.

[Kukkadapu]

But if I pipe

| fields abc then abc is showed in the fields list. But without that it doesn't show.

[jkat54]

Does it show in the fields picker if you change from 1% coverage to show all fields and then type the field name into the seacb bar in the fields picker? If so, just select the fields you want to see by default and they'll always be selected for your user when you're in that app context.

[Kukkadapu]

NO, It doesn't show even if I change the coverage

[jkat54]

I believe the other thing it does which may be causing the issue, is it only samples a certain number of events. I believe the limit is set under [associate] in limits.conf but i'm not 100% sure. I recommend opening a support case to get a definitive answer.