Splunk Search

Limited output for multivalue field


Hi Splunkers,

we have JSON logs with multiple values for a single field - list of identities - up to 1000.
I need to extract all values from the list, e.g. using mvexpand. But the number is always less than expected. Also it is limited if simply looking at multivalue field (pre-mvexpand output) in a search results windows .
Looks like it is limited by size, as approximately the size of raw text data, that we get in output is around 10Kb.
In limits.conf the most matching stanza is status_cache_size (default 10000).
Am I looking for the right condition?
Is increasing value formaxcols required if I don't care how much it shows for values(myfield)?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!