Feature Request: Add default search mode configuration setting
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start in package.json's contributes configuration section to trace how settings are declared, then locate the code that constructs Splunk SDK search jobs. Verify how the new default interacts with inline search_mode overrides and test that settings.json values apply to SPL queries from both .splnb notebooks and .spl files.
Written by the indexing model from the issue text.
Description
Feature Request
Problem Statement
When executing SPL queries in .splnb notebooks or .spl files, the extension currently uses the default Splunk search mode (typically "fast" or "smart"), which can miss events when fields are not extracted at index time. For indexes where field extraction happens at search time, this results in incomplete query results.
Requested Feature
Add a workspace/user configuration setting to specify the default search mode for SPL query execution:
"splunk.defaultSearchMode": "verbose" // Options: "fast", "smart", "verbose"
Use Case
In threat hunting and security analysis workflows, we frequently work with data sources where field extraction occurs at search time rather than index time. When searches run in fast mode, events can be missed because the search head doesn't parse all fields during query execution.
Desired Solution: Set a default in settings.json:
"splunk.defaultSearchMode": "verbose"
Benefits
- Consistency - Ensures all queries in a workspace execute with the appropriate search mode without manual annotation
- Accuracy - Reduces risk of incomplete results from fast mode searches on appropriate data sources
- Developer Experience - Eliminates repetitive inline parameter additions
- Flexibility - Users can still override with inline parameters when needed
Implementation Suggestions
- Add configuration option to
package.jsoncontributes section - Apply the setting when constructing search jobs via the Splunk SDK
- Allow per-query overrides with inline
search_mode=parameter - Consider adding to connection profile settings as an alternative
Related Splunk Documentation
- Search modes documentation
- Search job properties:
exec_mode,adhoc_search_level
- Dominant language
- Python
- Stars
- 97
- Forks
- 27
- Avg merge
- 3d 24m
- Merged PRs (30d)
- 2
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/vscode-extension-splunk
-
Difficulty 4/5 3-5 days Newbie friendliness 68/100
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
-
in progress
Difficulty 3/5 1-2 days Newbie friendliness 68/100
-
in progress
Difficulty 3/5 1-2 days Newbie friendliness 45/100
splunk/vscode-extension-splunk#153 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
All issues in splunk/vscode-extension-splunk
Similar issues
-
ライブラリを追加Openpriority middle
Difficulty 1/5 Under an hour Newbie friendliness 62/100
KATO-Hiro/AtCoderClans#13015 ·
Maintainers usually reply within 1 day
-
StringLiteral to IntegerType/LongType silently truncates fractional strings, changing predicate meaningPossibly taken @Shahzeb-DataEngineer claimed this today. Openkind:bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
apache/iceberg-python#4382 · 2 comments ·
Maintainers usually reply within 1 day
-
request-theme
Difficulty 2/5 Under an hour Newbie friendliness 62/100
LizardByte/ThemerrDB#10024 · 2 comments ·
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
btclib-org/btclib-node#2505 · 1 comment ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
open-webui/open-webui#34462 · 1 comment ·
Maintainers usually reply within 1 day