Splunk Search

how can we set the default search mode to verbose always. Can we set it from a config file.

johnsasikumar
Path Finder

Am running the calling the query from and SDK. Splunk returns results in Verbose mode. But it does not return results in smart

Tags (1)
0 Karma

DalJeanis
Legend

You are probably asking the wrong question. The correct question is: "What do I need to change in my search in order to get proper results in fast/smart mode?"

What is probably happening is that your search is implicitly depending on something that the fast search is not providing. This is not "normal", but it is common.

Here's one way to debug the query.

Start with the entire query, and remove one line at a time from the end until you get results. The last item removed will be related to the thing causing the problem.


Note 1 - Before you do the above, add a fields or table command to the bottom of your search and run it again. Certain calls, such as the base search in a dash, need to be told explicitly what they are providing to subsequent searches.


Note 2 - Depending on the search, in fast mode or smart mode splunk can return "results" without returning any "events". If you are in this situation, then you need to give us more specific information.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...