I have a search where, if I change from fast to verbose mode, I get different results. I'm wondering what are some possible reasons why they could differ.
A few references to other instances of this question:
It would help if you shared the query, input data, and both result sets.
besides @martin_mueller's comment you can find the answer in docs http://docs.splunk.com/Documentation/Splunk/6.2.6/Search/Changethesearchmode
Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required.
Verbose mode returns all of field and event data it possibly can, even if it means the search takes longer to complete, and even if the search includes reporting commands.
Discovers all of the fields it can. This includes default fields, automatic search-time field extractions, and all user-defined index-time and search-time field extractions. Discovered fields are displayed in the left-hand fields sidebar in the Events results tab.
Returns an event list view of results and generates the search timeline. It also generates report tables and visualizations if your search includes reporting commands.