Dashboards & Visualizations

Splunk Dashboard search mode vs Search in verbose mode

lmatilla
Explorer

Hi,

I have a dashboard that displays results below:

alt text

However, if you open it in search and change search mode to verbose, the result is somehow different:

alt text

Now, I'd like to know how do I change the dashboard search mode settings from its default (fast/smart? I'm not sure which.) to verbose via splunk web or via editing any config file. I've read module reference document already but don't know what file to configure or edit. Note that the problem is in the dashboard search mode.

0 Karma

lmatilla
Explorer

Hi! I guess that the problem is in the query after all. All search modes are displaying the same number of events but different results. This made me re-evaluate my query and edit it. Thanks, guys!

0 Karma

zomis
Explorer

What was the issue that you found in the query and how did you resolve it? I have a similar issue.

0 Karma

sbbadri
Motivator

Try to change ui-prefs.conf

[yourappname]
display.page.search.mode = verbose

for e.g.,

[search]
display.page.search.mode = verbose

0 Karma

lmatilla
Explorer

Hi! Thank you for your suggestion. When you inspect the job in the dashboard, the saved search properties of the job is now in verbose, however, the result in the dashboard did not change. The result still appear to be in smart mode.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>