Splunk Search

Why does the splunk indexes only 50 fields out of 120 fields from my Oracle DB table

aswathkhan
New Member

I have a table in the oracle database with 120 columns, but when I index the table into splunk using DB Connect only 50 column + 8 (splunk related columns) get indexed. I'm not sure why it is not indexing the remaining 70 columns.

Please help me fix this.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Not too familiar with DB Connect, but the default behaviour is to extract up to 50 key/value pairs. This is configured in limits.conf;

[kv]
limit = <integer>
* Maximum number of keys auto kv can generate.
* Defaults to 50.

Perhaps you should also have a look at;

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutfields

If field discovery is enabled, Splunk automatically:

    Identifies and extracts the first 50 fields that it finds in the event data that match obvious name/value pairs, such as user_id=jdoe or client_ip=192.168.1.1, which it extracts as examples of user_id and client_ip fields. (This 50 field limit is a default that can be modified by editing the [kv] stanza in limits.conf.)
    Extracts any field explicitly mentioned in the search that it might otherwise have found though automatic extraction (but isn't among the first 50 fields identified). 

Hope this helps,

Kristian

alacercogitatus
SplunkTrust
SplunkTrust

I believe when you are referring to "indexed" I think you mean "extracted". Additionally, you probably don't want to index that many fields. In the search UI, on the left side you should see a link of "View all x fields" where x is a number. If you click that, you should be able to see all of your extracted fields. And if not, then you will need to make sure the data is being extracted properly.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...