topic Load dashboard panels in verbose mode? in Dashboards & Visualizations

Load dashboard panels in verbose mode?

clymbouris — Mon, 05 May 2014 10:35:29 GMT

Is there any way I can load charts in a dashboard based on a verbose search? I tried saving a report with verbose which shows all the intended results but still loads in fast mode when linked to a dashboard panel.

I'm using Splunk 6

Here's a search that might show the difference a bit better...

eventtype=tickets assignee=aUser | convert timeformat="%Y-%m-%d %T" mktime(created_at) | fieldformat created_at=strftime(created_at,"%Y-%m-%d %T") | convert timeformat="%Y-%m-%d %T" mktime(closed_at) | fieldformat closed_at=strftime(closed_at,"%Y-%m-%d %T") | eval DaysOpen=round((now() - created_at)/3600/24,0) | eval DaysFromClose=round((now() - closed_at)/3600/24,0) | stats first(status) as status first(summary) as summary first(DaysOpen) as DaysOpen first(DaysFromClose) as DaysFromClose first(due_at) as due_at by ticket_number,assignee | search (status="open" AND DaysOpen>30) OR (status="closed" AND DaysFromClose<30) | top status

returns a count of

open = 18
closed = 17

searching the same thing in verbose mode returns a count of

open = 18
closed = 18

The number of results for both search modes is the same until I run the last search command:

search (status="open" AND DaysOpen>30) OR (status="closed" AND DaysFromClose<30)

Re: Load dashboard panels in verbose mode?

somesoni2 — Mon, 05 May 2014 14:41:20 GMT

You can do set the search mode (fast | smart | verbose) in advanced xml. Go to below link and search for module "SearchMode"

http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/ModuleReference

Example implementation can be seen in flashtimeline view in Search app.

Re: Load dashboard panels in verbose mode?

martin_mueller — Mon, 05 May 2014 19:49:23 GMT

What's the search you're running?

Re: Load dashboard panels in verbose mode?

clymbouris — Mon, 28 Sep 2020 16:32:36 GMT

eventtype=tickets assignee=aUser | eval DaysSinceUpdate=round((now() - _time)/3600/24,0) | convert timeformat="%Y-%m-%d %T" mktime(due_at) | fieldformat due_at=strftime(due_at,"%Y-%m-%d %T") | eval DaysOverdue=round((now() - due_at)/3600/24,0) | stats first(status) as status values(summary) as Summary first(DaysSinceUpdate) as DaysSinceUpdate first(DaysOverdue) as DaysOverdue values(due_at) as due_at by ticket_number,creator | search (status="open" AND (DaysSinceUpdate>6 OR DaysOverdue>0)) | sort -DaysSinceUpdate

Re: Load dashboard panels in verbose mode?

martin_mueller — Tue, 06 May 2014 17:11:12 GMT

How do the results differ between fast mode and verbose mode?

Re: Load dashboard panels in verbose mode?

clymbouris — Wed, 07 May 2014 06:22:52 GMT

I've edited my original post to clarify this a bit better

Re: Load dashboard panels in verbose mode?

devin_stonecyph — Wed, 10 Sep 2014 22:19:53 GMT

Use eventstats instead of stats.

Re: Load dashboard panels in verbose mode?

yuanliu — Thu, 16 Feb 2017 21:01:34 GMT

I have the exact problem. Following link text and link text, I tried | fields * as well as eventstats as opposed to stats. It made no difference. Only verbose will give the correct result. (I also need to do this in Simple XML.)

Re: Load dashboard panels in verbose mode?

DalJeanis — Thu, 16 Feb 2017 21:52:17 GMT

yuan - best to create a new question with your details and link to this one, and you'll hopefully get feedback that is more useful to you.