Splunk Search

The command table does not show all fields

splk_clheureux
Explorer

My data :
_time MODULE NOMBRE_DE_WA_ECRITS [...]
2016-07-18 20:02:37 MOD1 10

My search :

eventtype=log_sepa
| table _time MODULE  *

Results are without NOMBRE_DE_WA_ECRITS :
_time MODULE [...]
2016-07-18 20:02:37 MOD1

When I do this search my field it's working :

    eventtype=log_sepa
    | table _time MODULE NOMBRE_DE_WA_ECRITS *

Results :
_time MODULE NOMBRE_DE_WA_ECRITS [...]
2016-07-18 20:02:37 MOD1 10

I can't write all the fields name because there are dynamics.

There is a limitation number for the fields to show ?

PS : In the limits.conf the property truncate_report is at false.

Thanks

Tags (2)

nick405060
Motivator

Same! I have many fields, including "reason" and "result".

<data> | table *

... does not show the two columns (it shows less than 50 other columns)

but

<data> | table reason result

... then shows both columns, and both are populated with data. In etc/system/local/limits.conf, maxcols=512 and truncate_report=false.

Anyone help with this?

<<< Additional tags: Duo app, Duo add-on >>>

0 Karma

splk_clheureux
Explorer

The search eventtype=log_sepa | table _time * return the same results.
I juste find the answer. There is a limitation to 100 column in limits.conf

0 Karma

nick405060
Motivator

I downvoted this post because there is no limitation to 100 columns in limits.conf that i can see. Does not fix problem.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is solved, please accept the answer to help others find it in future.

---
If this reply helps you, Karma would be appreciated.
0 Karma

inventsekar
SplunkTrust
SplunkTrust

may i know what happens when you run -
eventtype=log_sepa
| table _time *

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...