What are some reasons why a Splunk search would return different results in verbose vs. fast mode?

[jaredlaney]

I have a search where, if I change from fast to verbose mode, I get different results. I'm wondering what are some possible reasons why they could differ.

A few references to other instances of this question:
http://answers.splunk.com/answers/230204/why-am-i-getting-different-results-in-verbose-mode.html
http://answers.splunk.com/answers/209374/query-in-fast-mode-showing-incorrect-data-and-gene.html

[MuS · Accepted solution]

Hi jaredlaney,

besides @martin_mueller's comment you can find the answer in docs http://docs.splunk.com/Documentation/Splunk/6.2.6/Search/Changethesearchmode

Fast mode
Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required.

• Disables field discovery. Field discovery is the process Splunk uses to extract fields aside from default fields such as host, source, and sourcetype. This means that Splunk only returns information on default fields and fields that are required to fulfill your search (if you are searching on certain fields, it will extract those fields).
• Only depicts search results as report result tables or visualizations when you run a reporting search (a search that includes transforming commands). Under the Fast mode you'll only see event lists and see event timelines for searches that do not include transforming commands.

Verbose mode
Verbose mode returns all of field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands.

• Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab.

• Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands.

cheers, MuS

[martin_mueller]

It would help if you shared the query, input data, and both result sets.