Dashboards & Visualizations
Highlighted

Splunk Dashboard search mode vs Search in verbose mode

Explorer

Hi,

I have a dashboard that displays results below:

alt text

However, if you open it in search and change search mode to verbose, the result is somehow different:

alt text

Now, I'd like to know how do I change the dashboard search mode settings from its default (fast/smart? I'm not sure which.) to verbose via splunk web or via editing any config file. I've read module reference document already but don't know what file to configure or edit. Note that the problem is in the dashboard search mode.

0 Karma
Highlighted

Re: Splunk Dashboard search mode vs Search in verbose mode

Motivator

Try to change ui-prefs.conf

[yourappname]
display.page.search.mode = verbose

for e.g.,

[search]
display.page.search.mode = verbose

0 Karma
Highlighted

Re: Splunk Dashboard search mode vs Search in verbose mode

Explorer

Hi! Thank you for your suggestion. When you inspect the job in the dashboard, the saved search properties of the job is now in verbose, however, the result in the dashboard did not change. The result still appear to be in smart mode.

0 Karma
Highlighted

Re: Splunk Dashboard search mode vs Search in verbose mode

Explorer

Hi! I guess that the problem is in the query after all. All search modes are displaying the same number of events but different results. This made me re-evaluate my query and edit it. Thanks, guys!

0 Karma
Highlighted

Re: Splunk Dashboard search mode vs Search in verbose mode

Explorer

What was the issue that you found in the query and how did you resolve it? I have a similar issue.

0 Karma