The pause on the stop menu can be used only during the searches running, and it is self-explanatory
to pause the search, to stop the search.
So there is a print option to print the entire web page.
There is an export option which by default has CSV, XML and JSON.
And also you can export the raw events.
That is nothing but your log file.
You can export it from here.
When you export all the events that are matching like 3000 plus events in the last 16 minutes from only
this filter.
When I say filter, we are just looking for Splunk internal audit logs.
If you want to see this log, you cannot export it from here.
We'll see how we can narrow down, how we can change our search to do a targeted charge to fetch the
information, what we need.
Then you should click on export and if you click on Raw Event, you'll get the actual log files.
If you get CSV, you'll get a good past the content of your logs specifying each field and its value
XML and JSON.
It will be in there specific values.
The next menu is one of the important that is smart, fast and verbose mode.
To differentiate them, there is a small description that is specified there.
You can go through that probably when you get an access to the Splunk instance as part of this complete
package.
Course, it is nothing but the fast.
It's the fastest, the smartest, the smartest, and the verbose is the dumbest.
It's like the first.
What it does is it extracts only minimum required fields.
Or only necessary feels.
Let us see.
We ran the last 60 minute search.
Let us run for the fast mode.
And let us see.
How does this look?
First.
The main difference is here we have three interesting fields, three selected fields.
And the first, let's see in how much time this job was completed.
You can see that by clicking on Job, edit, inspect job, you'll be able to see that it was completed
in point 4 seconds.
That was for last 60 minutes in fast mode.
Let's go to smart mode.
Smart mode is like the smarter one which gets the information which is needed.
Like if I write a query to get the raw events, it will show me the raw events.
If I write a query to display a visualization or a chart, it displays only the chart.
It doesn't display my raw events.
That is how the smart mode works.
It just gives you the information what you need in this smart mode.
You can see there are a lot, many, many more fields which says these are interesting fields and it
will be useful.
Smart mode as expected.
It automatically.
And this smart mode.
Let us see how much time it has taken to run our previous search.
That is the fast mode to current point four.
This took our on point three.
This was fastest.
How can that be?
The first mode ran again.
Let me search again.
See the first mode took around .3.2 3 seconds.
Our smart mode, it basically refreshes from the cache.
That's the reason from the fast mode to smart mode.
It showed as it was less.
So let us see.
This would have taken much greater than what fast more took this 2.38 whereas fast more 2.2 3 seconds.
But if I run the same search in verbose mode, it will take even longer.
It will add.
It will try to add more information, get more meta information and field information to the logs.
And since we are running the same search over and over again, most of them will be stored from Splunk
Cache and as you can see, our verbose mode.
Which took point 4 seconds when you compared to fast it was 0.23 when we compared to smart it was 0.38.
And when you compare to Verbose, it is 0.4.
This is okay for running a 60 minute search, but imagine if you are running a search for three months.
The verbose mode will run for like ever.
As a Splunk admin, you should make sure that verbose mode is absolutely not used and it is only used
whenever there is a real need for using it.
Most of the time you'll be able to get your job done by your smart mode.
We'll see.
One more example for smart mode.
Let's say I have a field called Action.
Here, I'll click on the top values.
I'll.
My search query is auto updated and the search is running now.
It automatically populated visualization, which shows top 20 values by default.
Here I am running it on sport mode.
If I go back to events, I can't see any event.
It clearly says you didn't run this in verbose mode.
If you want to see the events along with your chart, you need to run in verbose mode, running and
verbose more.
It's like performing heavy duty on your Splunk.
It will just kill your resources.
So make sure verbose mode is used whenever it is necessary.