Splunk Search

How to get searches to run in Smart or Verbose mode when selecting "Open In Search" from a dashboard panel?

Explorer

All my dashboards panels, written in Simple XML, default to Search Mode "Fast" when the "Open In Search" icon is selected. To see the event details, either "Smart" or "Verbose" mode needs to then be selected which is a major PITA.

Is there any way to get these searches to run in either Smart or Verbose mode upon selecting the "Open in Search" option from the dashboard panel?

Thanks,
Frank

Explorer

I had a problem of my workflow actions not being available in the dashboard because the fields were not showing up. I added | fields * to the end of my search and it forced the search to run in verbose mode making my workflow actions available again.

Splunk Employee
Splunk Employee

this is really important when using post-process searches. Add | fields * to the base search. Thanks for the tip!

0 Karma

Communicator

Maybe try dropping this in your source/xml: <param name="searchModeLevel">verbose</param>

http://docs.splunk.com/Documentation/Splunk/6.1.3/AdvancedDev/ModuleReference