We're using the fieldsummary function in splunk to return the list of fields (as it was designed) for each of our indexes. This works great for almost all our indexes except for our windows snare index. When fieldsummary is run on this index we get all the fields plus each individual log line being returned.
Does anyone know how fieldsummary works and if the query can be run manually? and/or if there's some sort of character limitation on fieldsummary that our windows event logs are tripping causing it spew all the log lines when the command is executed?
not sure if this is what the problem is, but are you explicitly setting the maxvals argument? it has a default value of 100 distinct values to return for each field if you don't set it explicitly.
also, can you provide the search string you're using and a sample of the data that is working and a sample of what's not?
also, what do you mean by running the query manually? it's a search command, so you can run it on the commandline if you have the necessary permissions.