Dashboard not showing correct results

[KevinAdu]

Hello,

I have created a dashboard with some very simple searches, for example:

index=something | stats count

In our dashboard every time it is run the results seem to vary. When run in the search bar we seem to consistently get the same result as expected. After a bit of research I realised that dashboards are run in Fast Mode. So I decided to change the dashboards so that they run in Verbose mode. The way I have done that was changing the dashboard to HTML and adding the following line to the search managers in the JavaScript portion:

"adhoc_search_level": "verbose"

Now after adding this, the correct results consistently show in dashboards. This is undesirable as it make the dashboards a bit difficult for us to change and other reasons.

So my questions are:

1) Why is this happening? Surely depending on what mode you run your search in, it shouldn't affect the results.
2) Is there any other way to solve this without converting my dashboard into an HTML one?

Thanks for you time.

[MuS]

Hi KevinAdu,

1. read the docs about the search modes http://docs.splunk.com/Documentation/Splunk/6.2.5/Search/Changethesearchmode and how they effect field extractions.
2. not sure on this, using simple XML and I never had such a problem.

cheers, MuS