Splunk Dashboard search mode vs Search in verbose mode

[lmatilla]

Hi,

I have a dashboard that displays results below:

However, if you open it in search and change search mode to verbose, the result is somehow different:

Now, I'd like to know how do I change the dashboard search mode settings from its default (fast/smart? I'm not sure which.) to verbose via splunk web or via editing any config file. I've read module reference document already but don't know what file to configure or edit. Note that the problem is in the dashboard search mode.

[lmatilla]

Hi! I guess that the problem is in the query after all. All search modes are displaying the same number of events but different results. This made me re-evaluate my query and edit it. Thanks, guys!

[zomis]

What was the issue that you found in the query and how did you resolve it? I have a similar issue.

[sbbadri]

Try to change ui-prefs.conf

[yourappname]
display.page.search.mode = verbose

for e.g.,

[search]
display.page.search.mode = verbose

[lmatilla]

Hi! Thank you for your suggestion. When you inspect the job in the dashboard, the saved search properties of the job is now in verbose, however, the result in the dashboard did not change. The result still appear to be in smart mode.