Am running the calling the query from and SDK. Splunk returns results in Verbose mode. But it does not return results in smart
You are probably asking the wrong question. The correct question is: "What do I need to change in my search in order to get proper results in fast/smart mode?"
What is probably happening is that your search is implicitly depending on something that the fast search is not providing. This is not "normal", but it is common.
Here's one way to debug the query.
Start with the entire query, and remove one line at a time from the end until you get results. The last item removed will be related to the thing causing the problem.
Note 1 - Before you do the above, add a fields
or table
command to the bottom of your search and run it again. Certain calls, such as the base search in a dash, need to be told explicitly what they are providing to subsequent searches.
Note 2 - Depending on the search, in fast mode or smart mode splunk can return "results" without returning any "events". If you are in this situation, then you need to give us more specific information.