I seem to be encounting some sort of limit on the number of columns that are being displayed. Here is the gist of what I am doing:
Only the first eval statement seems to be completing, adding just that one column. The others seem to just disappear into the ether.
Is there some sort of implicit or explicit limit on the number of columns that can be processed, output, etc?
Can you see the names of disappeared fields into the field picker on the left?
This might be related to how the browser displays a long list of columns frequently leading to a lot of horizontal scrolling to reach the last ones. Have you tried to put a "table" command at the end of the query, listing all your interesting columns?
.... | table _time colA colB colC
You might still need to reach the bottom of the page and scroll throught the horizontal scrollbar.
There is definitely no horizontal scroll bar. I will look at the 'table' command. Have not used that before. Right now I am just explicitly listing the columns that I wanted displayed using the fields command.
Paulo - Using the table command instead of the fields command seems to have addressed the issue. What is the difference? are there times when using 'table' instead of 'fields' is preferable?
Nice I was able to help. Actually those commands have different use cases. "fields" actually restricts the field extractions automatically performed by Splunk (..| fields + A B C will discard all the fields which are not A, B or C). You can use it to boost performance as there's no need to compute stats for the fields which you dismisse. "table" instead is used to show the selected fields in a tabular manner (in the "results table" panel), while the others are still hanging in the field picker (so no performance increase there).