Alerting

Running Alerts in Verbose or Fast mode

jamin358
Explorer

Hi everyone,

I have an alert that I want to run that will only give me the correct answer if run in verbose mode (contains look-ups and evals). Is there any way to change the search mode of the automated search? I dont mean the "display.page.search.mode = verbose" as this only works at the display level as the documentation states.

Thanks in advance

0 Karma
1 Solution

davpx
Communicator

Fast vs Smart vs Verbose is only for UI searches. The functionality you describe does not exist.

View solution in original post

davpx
Communicator

Fast vs Smart vs Verbose is only for UI searches. The functionality you describe does not exist.

king2jd
Path Finder

Can you post your query?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...