Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise Security
- :
- Field Extractor
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
The field extractor stops at line 20. If what I am looking for is on a line after that what can I do to pull that information?
I have looked for other threads to no avail. If one exists please by all means point me in that direction.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So it turns out I was wrong, before, so I deleted my previous response. I don't know what was going on before but now I am also in your same position. I looked it up further and it turns out lots of people are having this issue, as well. For some reason, it is capped at 20, and there doesn't seem to be a way around it without extracting it manually, in the search. I'll let you know if I actually find something.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ya I realize the parsing could/should be better but unfortunately I don't have that type of administrative control.
Capping it at 20 lines makes no sense at all.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I came across an app yesterday that someone made for download at Splunkbase that allows the field extractor to be more customizable. However, it is not made by Splunk, so I wouldn't download it myself. Let me know if you find a solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So it turns out I was wrong, before, so I deleted my previous response. I don't know what was going on before but now I am also in your same position. I looked it up further and it turns out lots of people are having this issue, as well. For some reason, it is capped at 20, and there doesn't seem to be a way around it without extracting it manually, in the search. I'll let you know if I actually find something.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Data Management Digest – May 2026
Index This | What is feather-light but cannot be held long?
.conf26 Registration is Live: Secure Your Early Bird Pass Now
