Splunk Search

how can we set the default search mode to verbose always. Can we set it from a config file.

johnsasikumar
Path Finder

Am running the calling the query from and SDK. Splunk returns results in Verbose mode. But it does not return results in smart

Tags (1)
0 Karma

DalJeanis
Legend

You are probably asking the wrong question. The correct question is: "What do I need to change in my search in order to get proper results in fast/smart mode?"

What is probably happening is that your search is implicitly depending on something that the fast search is not providing. This is not "normal", but it is common.

Here's one way to debug the query.

Start with the entire query, and remove one line at a time from the end until you get results. The last item removed will be related to the thing causing the problem.


Note 1 - Before you do the above, add a fields or table command to the bottom of your search and run it again. Certain calls, such as the base search in a dash, need to be told explicitly what they are providing to subsequent searches.


Note 2 - Depending on the search, in fast mode or smart mode splunk can return "results" without returning any "events". If you are in this situation, then you need to give us more specific information.

Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...