Dashboards & Visualizations

Splunk Dashboard search mode vs Search in verbose mode

lmatilla
Explorer

Hi,

I have a dashboard that displays results below:

alt text

However, if you open it in search and change search mode to verbose, the result is somehow different:

alt text

Now, I'd like to know how do I change the dashboard search mode settings from its default (fast/smart? I'm not sure which.) to verbose via splunk web or via editing any config file. I've read module reference document already but don't know what file to configure or edit. Note that the problem is in the dashboard search mode.

0 Karma

lmatilla
Explorer

Hi! I guess that the problem is in the query after all. All search modes are displaying the same number of events but different results. This made me re-evaluate my query and edit it. Thanks, guys!

0 Karma

zomis
Explorer

What was the issue that you found in the query and how did you resolve it? I have a similar issue.

0 Karma

sbbadri
Motivator

Try to change ui-prefs.conf

[yourappname]
display.page.search.mode = verbose

for e.g.,

[search]
display.page.search.mode = verbose

0 Karma

lmatilla
Explorer

Hi! Thank you for your suggestion. When you inspect the job in the dashboard, the saved search properties of the job is now in verbose, however, the result in the dashboard did not change. The result still appear to be in smart mode.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...