Why does the splunk indexes only 50 fields out of 120 fields from my Oracle DB table

[aswathkhan]

I have a table in the oracle database with 120 columns, but when I index the table into splunk using DB Connect only 50 column + 8 (splunk related columns) get indexed. I'm not sure why it is not indexing the remaining 70 columns.

Please help me fix this.

[kristian_kolb]

Not too familiar with DB Connect, but the default behaviour is to extract up to 50 key/value pairs. This is configured in limits.conf;

[kv]
limit = <integer>
* Maximum number of keys auto kv can generate.
* Defaults to 50.

Perhaps you should also have a look at;

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Aboutfields

If field discovery is enabled, Splunk automatically:

    Identifies and extracts the first 50 fields that it finds in the event data that match obvious name/value pairs, such as user_id=jdoe or client_ip=192.168.1.1, which it extracts as examples of user_id and client_ip fields. (This 50 field limit is a default that can be modified by editing the [kv] stanza in limits.conf.)
    Extracts any field explicitly mentioned in the search that it might otherwise have found though automatic extraction (but isn't among the first 50 fields identified). 

Hope this helps,

Kristian

[alacercogitatus]

I believe when you are referring to "indexed" I think you mean "extracted". Additionally, you probably don't want to index that many fields. In the search UI, on the left side you should see a link of "View all x fields" where x is a number. If you click that, you should be able to see all of your extracted fields. And if not, then you will need to make sure the data is being extracted properly.