The search you ran returned a number of fields that exceeded the current indexed field extraction limit='200' To ensure that all fields are extracted for search, set limits.conf: [kv] / indexed_kv_limit to a number that is higher than the number of fields contained in the files that you index.
I am getting above error while on the left side I have only 35-10 fields extracted during search time. Log is ingested with Splunk HEC using Splunk_TA_nix with linux_secure stanza.
How can I detect what is causing above error as didn't find anything that will create indexed fields, etc...and I didn't see fields on the left created.
How to troubleshoot this?
With search like this, I got 11 fields | walklex index="<index_name>" type=field | search NOT field=" *" | stats list(distinct_values) by field