Splunk Search

How to return more than 10 columns in a table search result?

thomas_forbes
Communicator

I have a search that searches for Windows Security Event IDs and displays the results in a table format. The maximum number of columns seems to be only 10, but in reality I am returning 15 to 20 columns (Event IDs) depending on what type of search I am running. I would like to increase the number of columns I can display to match the number of Event IDs that are returned from my original search.

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

If you're using chart OR timechart to display your data in table, try to include "limit=0" with chart/timechart. Something like this

your base search | timechart count by sourcetype limit=0

View solution in original post

somesoni2
Revered Legend

If you're using chart OR timechart to display your data in table, try to include "limit=0" with chart/timechart. Something like this

your base search | timechart count by sourcetype limit=0

thomas_forbes
Communicator

Hey somesoni2, that worked like a charm. I thought it was something simple. Thanks again for the help.

Tom

0 Karma

thomas_forbes
Communicator

Hey somesoni2, that worked like a charm. I thought it was something simple. Thanks again for the help.

Tom

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...