Hello, I'm looking for details on indexed_kv_limit parameter following an upgrade from 7.x to 8.x. After an upgrade, I saw a warning message from my indexers saying : The search you ran returned a number of fields that exceeded the current indexed field extraction limit. To ensure that all fields are extracted for search, set limits.conf: [kv] / indexed_kv_limit to a number that is higher than the number of fields contained in the files that you index. When I inspect the job, I noticed many lookup are loaded by AutoLookupDriver not related to my sourcetype. These lookup are configured by various TA (palo alto, cisco et c....). After, the lookup loading, I noticed more than 400 fields appears in Final required field list. Are Fields required related to lookup loaded ? (from my understanding : yes) However, I don't understand why the search doesn't limit the lookup to the sourcetype of the logs. Is-it possible to limit these loading ? Regards.
... View more