I have a log statement with almost 100 fields. When searched, it doesn't show all the fields in Selected fields nor in All fields tab. Is there a limitation for the number of fields in Splunk? If so, where do I change it?
I used the
table command to make sure the missing fields are there, it's just not showing in the panel to the left.
Does it show in the fields picker if you change from 1% coverage to show all fields and then type the field name into the seacb bar in the fields picker? If so, just select the fields you want to see by default and they'll always be selected for your user when you're in that app context.
I believe the other thing it does which may be causing the issue, is it only samples a certain number of events. I believe the limit is set under [associate] in limits.conf but i'm not 100% sure. I recommend opening a support case to get a definitive answer.