Splunk Search

The command table does not show all fields

splk_clheureux
Explorer

My data :
_time MODULE NOMBRE_DE_WA_ECRITS [...]
2016-07-18 20:02:37 MOD1 10

My search :

eventtype=log_sepa
| table _time MODULE  *

Results are without NOMBRE_DE_WA_ECRITS :
_time MODULE [...]
2016-07-18 20:02:37 MOD1

When I do this search my field it's working :

    eventtype=log_sepa
    | table _time MODULE NOMBRE_DE_WA_ECRITS *

Results :
_time MODULE NOMBRE_DE_WA_ECRITS [...]
2016-07-18 20:02:37 MOD1 10

I can't write all the fields name because there are dynamics.

There is a limitation number for the fields to show ?

PS : In the limits.conf the property truncate_report is at false.

Thanks

Tags (2)

nick405060
Motivator

Same! I have many fields, including "reason" and "result".

<data> | table *

... does not show the two columns (it shows less than 50 other columns)

but

<data> | table reason result

... then shows both columns, and both are populated with data. In etc/system/local/limits.conf, maxcols=512 and truncate_report=false.

Anyone help with this?

<<< Additional tags: Duo app, Duo add-on >>>

0 Karma

splk_clheureux
Explorer

The search eventtype=log_sepa | table _time * return the same results.
I juste find the answer. There is a limitation to 100 column in limits.conf

0 Karma

nick405060
Motivator

I downvoted this post because there is no limitation to 100 columns in limits.conf that i can see. Does not fix problem.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is solved, please accept the answer to help others find it in future.

---
If this reply helps you, Karma would be appreciated.
0 Karma

inventsekar
SplunkTrust
SplunkTrust

may i know what happens when you run -
eventtype=log_sepa
| table _time *

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...