Fast mode being set automatically

[gmuller1]

I always use Verbose mode
Sometimes I open splunk and it is set as Fast mode as default, why is splunk switching from verbose to fast mode without my consent? Is this a setting where I can change? I've made a search but couldn't find.

[gmuller1]

Thanks all for the answers.

[MuS]

Hi gmuller1,

you can set a default search mode by using a ui-prefs.conf setting with this:

[default] 
display.page.search.mode = [fast|smart|verbose]

choose what ever mode you want as default, put it into $SPLUNK_HOME/etc/system/local/ and restart Splunk.

This should set the default search mode, but only until you change it again in the UI then it is saved in your session cookie.

Hope this helps ...

cheers, MuS

[rashi83]

Hi,

I have changed the said file to 

[default]
display.page.search.mode = [smart]

Location of file : C:\Program Files\Splunk\etc\system\local

But still UI is showing default as VERBOSE.

[chrisyounger · Accepted solution]

Dashboard searches (and other searches like this) always run in fast mode. So if you click the little magnifying glass to "break out" a search from a dashboard then it will carry-over that setting to your search pane. This is probably whats happening to you.

If you do set Smart/verbose mode, it does get saved in your personal settings directory, but only on a PER-APP basis. I expect this, coupled with the dashboard searches I mentioned above, means you will find yourself changing the search mode setting regularly.

I don't believe there is any way to change this behaviour.

All the best.