Splunk Search

What are some reasons why a Splunk search would return different results in verbose vs. fast mode?

jaredlaney
Contributor

I have a search where, if I change from fast to verbose mode, I get different results. I'm wondering what are some possible reasons why they could differ.

A few references to other instances of this question:
http://answers.splunk.com/answers/230204/why-am-i-getting-different-results-in-verbose-mode.html
http://answers.splunk.com/answers/209374/query-in-fast-mode-showing-incorrect-data-and-gene.html

Tags (3)
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi jaredlaney,

besides @martin_mueller's comment you can find the answer in docs http://docs.splunk.com/Documentation/Splunk/6.2.6/Search/Changethesearchmode

Fast mode
Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required.

  • Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).
  • Only depicts search results as report result tables or visualizations when you run a reporting search (a search that includes transforming commands). Under the Fast mode you'll only see event lists and see event timelines for searches that do not include transforming commands.

Verbose mode
Verbose mode returns all of field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands.

  • Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab.

  • Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands.

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi jaredlaney,

besides @martin_mueller's comment you can find the answer in docs http://docs.splunk.com/Documentation/Splunk/6.2.6/Search/Changethesearchmode

Fast mode
Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required.

  • Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).
  • Only depicts search results as report result tables or visualizations when you run a reporting search (a search that includes transforming commands). Under the Fast mode you'll only see event lists and see event timelines for searches that do not include transforming commands.

Verbose mode
Verbose mode returns all of field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands.

  • Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab.

  • Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands.

cheers, MuS

martin_mueller
SplunkTrust
SplunkTrust

It would help if you shared the query, input data, and both result sets.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...