Splunk Search

How to get searches to run in Smart or Verbose mode when selecting "Open In Search" from a dashboard panel?

franks59
Explorer

All my dashboards panels, written in Simple XML, default to Search Mode "Fast" when the "Open In Search" icon is selected. To see the event details, either "Smart" or "Verbose" mode needs to then be selected which is a major PITA.

Is there any way to get these searches to run in either Smart or Verbose mode upon selecting the "Open in Search" option from the dashboard panel?

Thanks,
Frank

nburgess1
Explorer

I had a problem of my workflow actions not being available in the dashboard because the fields were not showing up. I added | fields * to the end of my search and it forced the search to run in verbose mode making my workflow actions available again.

bnorthway_splun
Splunk Employee
Splunk Employee

this is really important when using post-process searches. Add | fields * to the base search. Thanks for the tip!

0 Karma

rewritex
Contributor

Maybe try dropping this in your source/xml: <param name="searchModeLevel">verbose</param>

http://docs.splunk.com/Documentation/Splunk/6.1.3/AdvancedDev/ModuleReference

Jugabanhi
Explorer

Hi @rewritex ,

Could you please give a snippet of the same. On click of search icon of panels in my dashboard, the queries are running to verbose mode only, want to change it to fast mode. I am using Base search in my dashboard.

Since export option is not available, trying out this scenerio, but I have a good amount of data, as such running in verbose mode is something trying to avoid.

@all, please suggest some.

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...