verbose mode is meant to help user to see automatically extracted field on the left pane in Event Viewer in search app. This is requires extra resource usage and making search slower. So, scheduled search won't use verbose mode because scheduled search does not required extra field extraction for event viewer. As you are describing, if your scheduled search does not return results and the same search does not return result in "Fast mode", but the same search returns results in "Verbose mode" Something is wrong. I recommend to file a Support case. It might be a bug. ... View more

In inputs.conf, there is a property called "ignoreOlderThan". Setting this property will ensure that the files whose last modification time is older than specified values (e.g. 1d, one day) will be ignored. See more here:- http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Inputsconf ... View more