Splunk Search
Highlighted

How to return more than 10 columns in a table search result?

Communicator

I have a search that searches for Windows Security Event IDs and displays the results in a table format. The maximum number of columns seems to be only 10, but in reality I am returning 15 to 20 columns (Event IDs) depending on what type of search I am running. I would like to increase the number of columns I can display to match the number of Event IDs that are returned from my original search.

Tags (3)
0 Karma
Highlighted

Re: How to return more than 10 columns in a table search result?

SplunkTrust
SplunkTrust

If you're using chart OR timechart to display your data in table, try to include "limit=0" with chart/timechart. Something like this

your base search | timechart count by sourcetype limit=0

View solution in original post

Highlighted

Re: How to return more than 10 columns in a table search result?

Communicator

Hey somesoni2, that worked like a charm. I thought it was something simple. Thanks again for the help.

Tom

0 Karma
Highlighted

Re: How to return more than 10 columns in a table search result?

Communicator

Hey somesoni2, that worked like a charm. I thought it was something simple. Thanks again for the help.

Tom

0 Karma