Archive

What has changed in Splunk 7 regarding search modes?

Explorer

I have a search that seems to work in any mode (fast, smart, verbose) on 6.6.2, but only works in smart or verbose mode on 7.1.0. Perhaps my regex field extraction is no longer working properly?

The search looks sort of like this

index=testindex sourcetype=testsource host=* testfield=123

Another weird quirk is that when I run the search on 7.1.0 I get no results in fast mode, unless I add | table * , in which case I then get results.

I would like to know what changed around this so that I can figure out to what extent it could affect reports, alerts, and dashboards.

Edit: This does seem limited to a specific sourcetype, I can run a similar search in Fast Mode on another sourcetype and it works as it did before.

Edit2: This is not limited to a specific sourcetype. The reason it was working on the other sourcetype is that the search was able to do a raw text search for testfield=123 and find it. In my scenario a raw text search does not work.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!