Missing columns when searching

[jcbrendsel]

I seem to be encounting some sort of limit on the number of columns that are being displayed. Here is the gist of what I am doing:

1. Base search generates 8 columns.
2. Join to a lookup table that adds another 10 columns.
3. A series of eval statements that add another 5 columns.

Only the first eval statement seems to be completing, adding just that one column. The others seem to just disappear into the ether.

Is there some sort of implicit or explicit limit on the number of columns that can be processed, output, etc?

Jon.

[Paolo_Prigione · Accepted solution]

Can you see the names of disappeared fields into the field picker on the left?

This might be related to how the browser displays a long list of columns frequently leading to a lot of horizontal scrolling to reach the last ones. Have you tried to put a "table" command at the end of the query, listing all your interesting columns?

.... | table _time colA colB colC 

You might still need to reach the bottom of the page and scroll throught the horizontal scrollbar.

[Paolo_Prigione]

Nice I was able to help. Actually those commands have different use cases. "fields" actually restricts the field extractions automatically performed by Splunk (..| fields + A B C will discard all the fields which are not A, B or C). You can use it to boost performance as there's no need to compute stats for the fields which you dismisse. "table" instead is used to show the selected fields in a tabular manner (in the "results table" panel), while the others are still hanging in the field picker (so no performance increase there).

[jcbrendsel]

Paulo - Using the table command instead of the fields command seems to have addressed the issue. What is the difference? are there times when using 'table' instead of 'fields' is preferable?

[jcbrendsel]

There is definitely no horizontal scroll bar. I will look at the 'table' command. Have not used that before. Right now I am just explicitly listing the columns that I wanted displayed using the fields command.