How to run a dashboard search in verbose mode through Simple XML?

[rdownie]

I am trying to run a dashboard search in verbose mode. I am using workflow actions from within the events, but the required fields for the workflow action are not populating. I need this to be done in simple XML (through simple XML).

[Lowell]

Ran into the same basic problem, and still can't find any explicit support for "Verbose" mode in Simple XML as of Splunk 6.5. However, that being said, a very simple but effective work around is to simply add a | fields * to your search.

<base search> | fields * | ...

[frobinson_splun]

Hi @rdownie,
You could try adjusting the settings for the saved search that drives this visualization. In savedsearches.conf, there is a display.page.search.mode setting that allows you to set the mode.

See

http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Savedsearchesconf#Display_Formatting_Options

See also this previous Answers discussion for more info and possible limitations on the setting:

https://answers.splunk.com/answers/124352/scheduled-report-in-verbose-mode.html

Hope this helps!

[rdownie]

I figured a workaround, by adding fieldname=* fieldname2=* to the search, it added them to the output in fast mode. I would like to still find a way to force it to verbose mode in a dashboard if that is possible.

[somesoni2]

I don't think so there is an option in Simple xml to change search mode (in advanced xml, yes). Your solution is more of best practice than workaround.