Splunk Search

What reasons could cause a user to lose their Splunk search history?

brent_weaver
Builder

I have a user that lost his search history in Splunk search. Any ideas why? I did not lose mine but he did?!?!

0 Karma

mydog8it
Builder

Your Search History is presented in the app you used to launch the Search. I have a default app that is created for my users and search is available to them in that app. The Search History that accumulates in that app does not propagate to other apps. So if the user navigates outside of their default app and lunches search from that location their history is not available to them that was "learned" in the default app.

Hope this helps...

pruthvikrishnap
Contributor

Hi,

Try using the |history command, please find the complete details in this link
https://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/History

if that doesnt work try below search:
index=_internal user=* sourcetype=splunkd_ui_access | dedup q | table _time, q | eval q=urldecode(q)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...