I am using Splunk 6.1.4. I had the same issue, tried modifying maxcols, and it did not work for me. So I took a peek at $SPLUNK_HOME/etc/system/default/limits.conf and observed a couple more parameters to change. I modified $SPLUNK_HOME/etc/system/local/limits.conf to contain the following: [kv] # when non-zero, the point at which kv should stop creating new columns maxcols = 1800 # maximum number of keys auto kv can generate limit = 500 # truncate _raw to to this size and then do auto KV maxchars = 102400 That seems to have worked for me. ... View more