topic How to run a dashboard search in verbose mode through Simple XML? in Splunk Search

How to run a dashboard search in verbose mode through Simple XML?

rdownie — Thu, 19 May 2016 14:15:24 GMT

I am trying to run a dashboard search in verbose mode. I am using workflow actions from within the events, but the required fields for the workflow action are not populating. I need this to be done in simple XML (through simple XML).

Re: How to run a dashboard search in verbose mode through Simple XML?

rdownie — Thu, 19 May 2016 14:24:49 GMT

I figured a workaround, by adding fieldname=* fieldname2=* to the search, it added them to the output in fast mode. I would like to still find a way to force it to verbose mode in a dashboard if that is possible.

Re: How to run a dashboard search in verbose mode through Simple XML?

somesoni2 — Thu, 19 May 2016 16:54:34 GMT

I don't think so there is an option in Simple xml to change search mode (in advanced xml, yes). Your solution is more of best practice than workaround.

Re: How to run a dashboard search in verbose mode through Simple XML?

frobinson_splun — Fri, 20 May 2016 23:43:04 GMT

Hi @rdownie,
You could try adjusting the settings for the saved search that drives this visualization. In savedsearches.conf, there is a display.page.search.mode setting that allows you to set the mode.

See

http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Savedsearchesconf#Display_Formatting_Options

See also this previous Answers discussion for more info and possible limitations on the setting:

https://answers.splunk.com/answers/124352/scheduled-report-in-verbose-mode.html

Hope this helps!

Re: How to run a dashboard search in verbose mode through Simple XML?

Lowell — Thu, 20 Oct 2016 17:19:31 GMT

Ran into the same basic problem, and still can't find any explicit support for "Verbose" mode in Simple XML as of Splunk 6.5. However, that being said, a very simple but effective work around is to simply add a | fields * to your search.

<base search> | fields * | ...