Hi Splunkers,
we have JSON logs with multiple values for a single field - list of identities - up to 1000.
I need to extract all values from the list, e.g. using mvexpand. But the number is always less than expected. Also it is limited if simply looking at multivalue field (pre-mvexpand output) in a search results windows .
Looks like it is limited by size, as approximately the size of raw text data, that we get in output is around 10Kb.
In limits.conf the most matching stanza is `status_cache_size` (default 10000).
Am I looking for the right condition?
Is increasing value for`maxcols` required if I don't care how much it shows for values(myfield)?
↧