INDEXED_EXTRACTIONS Missing Fields in Large JSON Events

Available Languages

Updated:September 29, 2026
Document ID:SPLK046303

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

JSON events extracted and sent to a summary index but not all events are extracted
Seems to be random, sometimes fields are accessible, and sometimes they are not 
INDEXED_EXTRACTIONS = json

Original events for the savedsearch which fills the index are also JSON encoded events which are correctly extracted
Fields that are too long for the JSON search are dropped
 

Resolution

Increase the max number of fields values in limits.conf 
[kv]
indexed_kv_limit = 10000
maxchars = 10000

According to the Splunk Documentation limits.conf
  
indexed_kv_limit = <integer>
* The maximum number of fields that can be extracted at index time from a data source.
* This setting does not prevent a search from extracting indexed fields that
  the search needs and explicitly requests.
* The Splunk platform imposes this limit for each index bucket.
* Fields that can be extracted at index time include default fields, custom fields,
  and structured data header fields.
* The summary fields 'host', 'index', 'source', 'sourcetype', 'eventtype', 'linecount',
  'splunk_server', and 'splunk_server_group' do not count against this limit and are
  always returned.
* Increase this setting if, for example, you have indexed data with a large
  number of columns and want to ensure that the field picker in the Splunk Web search
  page displays all fields.
* This setting is different from the 'limit' setting in that it limits field
  extraction in different phases of data processing. Previously, the 'limit'
  setting handled both index-time and search-time field extraction limits, and
  to maintain backward compatibility, both settings work in concert.
* The Splunk platform always uses the higher value for either setting to enforce
  index-time field extraction limits.
  * For example, if you set 'indexed_kv_limit' to "500" and 'limit' to "200",
    then the platform limits indexed-time field extractions to 500 and
    search-time field extractions to 200.
  * If you set 'indexed_kv_limit' to "200" and 'limit' to "500", then the
    platform limits both index-time and search-time field extraction to 500.
* Set this value to 0 if you do not want to limit the number of fields
  that can be extracted at index time.
* Default: 200maxchars = <integer>
* Truncate _raw to this size and then do auto KV.
* Default: 10240 characters


 
Splunk Documentation limits.conf
 

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles