I have a search where, if I change from fast to verbose mode, I get different results. I'm wondering what are some possible reasons why they could differ.
A few references to other instances of this question:
http://answers.splunk.com/answers/230204/why-am-i-getting-different-results-in-verbose-mode.html
http://answers.splunk.com/answers/209374/query-in-fast-mode-showing-incorrect-data-and-gene.html
Hi jaredlaney,
besides @martin_mueller's comment you can find the answer in docs http://docs.splunk.com/Documentation/Splunk/6.2.6/Search/Changethesearchmode
Fast mode
Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required.
Verbose mode
Verbose mode returns all of field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands.
Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab.
Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands.
cheers, MuS
Hi jaredlaney,
besides @martin_mueller's comment you can find the answer in docs http://docs.splunk.com/Documentation/Splunk/6.2.6/Search/Changethesearchmode
Fast mode
Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required.
Verbose mode
Verbose mode returns all of field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands.
Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab.
Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands.
cheers, MuS
It would help if you shared the query, input data, and both result sets.