Splunk Search

getting results in verbose mode but not in smart or fast mode

ips_mandar
Builder

I have indexed file using INDEXED_EXTRACTION=csv in props.conf
when I search index=abc field_name=123 I get results in all three modes i.e. fast/smart/verbose mode and all fields are getting extracted as expected but when I try

index=abc field_name=123|table field_name 

I only get results in Verbose mode and fast/smart mode gives no results. Then I tried using fields in search still same issue.

index=abc field_name=123|fields *|table field_name 

This will also give results in Verbose mode and fast/smart mode gives no results.
Kindly help on this to resolve issue .
Thanks,

0 Karma

ololdach
Builder

INDEXED_EXTRACTION is a field extraction done at index time. All fields are being extracted when the data is indexed and they are always available in the events. The Search Mode (Fast/Verbose/Smart) only affects what is displayed at search time. Just to clarify: I assume that with "results" you mean that when you switch to the Events tab of the search results, you see no fields when you turn/open the twistie on an event.
1. index=abc field_name=123|table field_name- All fields in the head of the search appear in the Events, regardless of the search level. Thus, in all levels you will see index and field_name, both being highlighted (yellow). Smart and verbose will show all fields extracted at index time
2. index=abc - In "fast" mode, you will only see index, but no additional fields will be shown.
3. index=abc fieldname=123|fields *|table field_name - Same as in 1

Please note: The fields command affects the internal representation of the result. fields - <name> will remove a field from the result. After fields - field_name expanding the Events will no longer show field_name. fields + * (equivalent to fields *) keeps all fields that ** already are in the result** in the result (It does nothing.) Hence the + is misleading. Adding a field that does not exist in your result ... | fields + newfield |... will in effect remove all fields and keep the non-existent. The field list will be empty after this.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ips_mandar,
I experienced this behaviour, in a past release there was also a bug so I had a different number of results between Modes!

Anyway, it's correct to have no results in Fast mode because you haven't any field for search.

It's not so clear in Smart Mode: did you tried to display results in Verbose mode, put field_name in interesting fields and then run the search again in Smart mode?

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...