Splunk Search

What reasons could cause a user to lose their Splunk search history?

brent_weaver
Builder

I have a user that lost his search history in Splunk search. Any ideas why? I did not lose mine but he did?!?!

0 Karma

mydog8it
Builder

Your Search History is presented in the app you used to launch the Search. I have a default app that is created for my users and search is available to them in that app. The Search History that accumulates in that app does not propagate to other apps. So if the user navigates outside of their default app and lunches search from that location their history is not available to them that was "learned" in the default app.

Hope this helps...

pruthvikrishnap
Contributor

Hi,

Try using the |history command, please find the complete details in this link
https://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/History

if that doesnt work try below search:
index=_internal user=* sourcetype=splunkd_ui_access | dedup q | table _time, q | eval q=urldecode(q)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...