Splunk Search

Why does the splunk indexes only 50 fields out of 120 fields from my Oracle DB table

New Member

I have a table in the oracle database with 120 columns, but when I index the table into splunk using DB Connect only 50 column + 8 (splunk related columns) get indexed. I'm not sure why it is not indexing the remaining 70 columns.

Please help me fix this.

Tags (1)
0 Karma

Ultra Champion

Not too familiar with DB Connect, but the default behaviour is to extract up to 50 key/value pairs. This is configured in limits.conf;

limit = <integer>
* Maximum number of keys auto kv can generate.
* Defaults to 50.

Perhaps you should also have a look at;


If field discovery is enabled, Splunk automatically:

    Identifies and extracts the first 50 fields that it finds in the event data that match obvious name/value pairs, such as user_id=jdoe or client_ip=, which it extracts as examples of user_id and client_ip fields. (This 50 field limit is a default that can be modified by editing the [kv] stanza in limits.conf.)
    Extracts any field explicitly mentioned in the search that it might otherwise have found though automatic extraction (but isn't among the first 50 fields identified). 

Hope this helps,



I believe when you are referring to "indexed" I think you mean "extracted". Additionally, you probably don't want to index that many fields. In the search UI, on the left side you should see a link of "View all x fields" where x is a number. If you click that, you should be able to see all of your extracted fields. And if not, then you will need to make sure the data is being extracted properly.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...