topic Re: Splunk Dashboard search mode vs Search in verbose mode in Dashboards & Visualizations

Splunk Dashboard search mode vs Search in verbose mode

lmatilla — Fri, 28 Jul 2017 01:47:50 GMT

Hi,

I have a dashboard that displays results below:

However, if you open it in search and change search mode to verbose, the result is somehow different:

Now, I'd like to know how do I change the dashboard search mode settings from its default (fast/smart? I'm not sure which.) to verbose via splunk web or via editing any config file. I've read module reference document already but don't know what file to configure or edit. Note that the problem is in the dashboard search mode.

Re: Splunk Dashboard search mode vs Search in verbose mode

sbbadri — Fri, 28 Jul 2017 03:42:05 GMT

Try to change ui-prefs.conf

[yourappname]
display.page.search.mode = verbose

for e.g.,

[search]
display.page.search.mode = verbose

Re: Splunk Dashboard search mode vs Search in verbose mode

lmatilla — Mon, 31 Jul 2017 02:18:33 GMT

Hi! Thank you for your suggestion. When you inspect the job in the dashboard, the saved search properties of the job is now in verbose, however, the result in the dashboard did not change. The result still appear to be in smart mode.

Re: Splunk Dashboard search mode vs Search in verbose mode

lmatilla — Thu, 03 Aug 2017 05:45:49 GMT

Hi! I guess that the problem is in the query after all. All search modes are displaying the same number of events but different results. This made me re-evaluate my query and edit it. Thanks, guys!

Re: Splunk Dashboard search mode vs Search in verbose mode

zomis — Tue, 10 Dec 2019 15:18:31 GMT

What was the issue that you found in the query and how did you resolve it? I have a similar issue.