how to see the data in table command which is showing empty cells

[venugoski]

i see the splunk query 
index="sample" "log_processed.env"=prod "log_processed.app"=sample "log_processed.traceId"=90cf115a05ebb87b2
| table _time, log_processed.message

this is displaying the empty messages in a table cell . i could the event in the raw format.
do i have any limit to see the whole message in table box .

[inventsekar]

Hi @venugoski .. out of 23 events some events(as shown in the 3rd event in table output) may not have that particular "log_processed.message". 

Lets doublecheck - pls check this one.. as the table command printing the _raw also, you can verify on same screen:

index="sample" "log_processed.env"=prod "log_processed.app"=sample "log_processed.traceId"=90cf115a05ebb87b2
| table _time log_processed.message _raw

[venugoski]

hi @inventsekar Thank you ,
you are right,  some events not have that particular "log_processed.message".
when i put | spath input=_raw i am seeing the events in table format but also seeing the duplicate events. can we avoid that.

index="sample" "log_processed.app"=mercury "log_processed.traceId"=dc57c0b7f0e8cfdee5002b62873f5de7 | spath input=_raw | table _time, log_processed.message

[yuanliu]

Drop spath.  Splunk is already giving you field values.  Adding spath as illustrated in your example will only give each field a duplicate value.  When your log source is JSON, spath can be used to extract from a specific field that embeds an escaped JSON, or to extract value of a specific path.  | spath input=_raw does neither.