Splunk Search

how can we set the default search mode to verbose always. Can we set it from a config file.

johnsasikumar
Path Finder

Am running the calling the query from and SDK. Splunk returns results in Verbose mode. But it does not return results in smart

Tags (1)
0 Karma

DalJeanis
Legend

You are probably asking the wrong question. The correct question is: "What do I need to change in my search in order to get proper results in fast/smart mode?"

What is probably happening is that your search is implicitly depending on something that the fast search is not providing. This is not "normal", but it is common.

Here's one way to debug the query.

Start with the entire query, and remove one line at a time from the end until you get results. The last item removed will be related to the thing causing the problem.


Note 1 - Before you do the above, add a fields or table command to the bottom of your search and run it again. Certain calls, such as the base search in a dash, need to be told explicitly what they are providing to subsequent searches.


Note 2 - Depending on the search, in fast mode or smart mode splunk can return "results" without returning any "events". If you are in this situation, then you need to give us more specific information.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...