Hi Splunkers,
we have JSON logs with multiple values for a single field - list of identities - up to 1000.
I need to extract all values from the list, e.g. using mvexpand. But the number is always less than expected. Also it is limited if simply looking at multivalue field (pre-mvexpand output) in a search results windows .
Looks like it is limited by size, as approximately the size of raw text data, that we get in output is around 10Kb.
In limits.conf the most matching stanza is status_cache_size (default 10000).
Am I looking for the right condition?
Is increasing value formaxcols required if I don't care how much it shows for values(myfield)?
