topic Re: Missing columns when searching in Splunk Search

Missing columns when searching

jcbrendsel — Sat, 22 Jan 2011 23:04:04 GMT

I seem to be encounting some sort of limit on the number of columns that are being displayed. Here is the gist of what I am doing:

Base search generates 8 columns.
Join to a lookup table that adds another 10 columns.
A series of eval statements that add another 5 columns.

Only the first eval statement seems to be completing, adding just that one column. The others seem to just disappear into the ether.

Is there some sort of implicit or explicit limit on the number of columns that can be processed, output, etc?

Jon.

Re: Missing columns when searching

Paolo_Prigione — Sun, 23 Jan 2011 01:21:02 GMT

Can you see the names of disappeared fields into the field picker on the left?

This might be related to how the browser displays a long list of columns frequently leading to a lot of horizontal scrolling to reach the last ones. Have you tried to put a "table" command at the end of the query, listing all your interesting columns?

.... | table _time colA colB colC

You might still need to reach the bottom of the page and scroll throught the horizontal scrollbar.

Re: Missing columns when searching

jcbrendsel — Sun, 23 Jan 2011 01:29:55 GMT

There is definitely no horizontal scroll bar. I will look at the 'table' command. Have not used that before. Right now I am just explicitly listing the columns that I wanted displayed using the fields command.

Re: Missing columns when searching

jcbrendsel — Mon, 24 Jan 2011 04:04:10 GMT

Paulo - Using the table command instead of the fields command seems to have addressed the issue. What is the difference? are there times when using 'table' instead of 'fields' is preferable?

Re: Missing columns when searching

Paolo_Prigione — Mon, 24 Jan 2011 19:49:38 GMT

Nice I was able to help. Actually those commands have different use cases. "fields" actually restricts the field extractions automatically performed by Splunk (..| fields + A B C will discard all the fields which are not A, B or C). You can use it to boost performance as there's no need to compute stats for the fields which you dismisse. "table" instead is used to show the selected fields in a tabular manner (in the "results table" panel), while the others are still hanging in the field picker (so no performance increase there).