topic Re: Search History in Feedback

Search History

SeoaneR — Tue, 11 Mar 2025 09:58:04 GMT

Hi there

Just wondering if it's possible to delete/remove searches from your search history list.

Looking to manage/tidy up the search history panel

Re: Search History

livehybrid — Tue, 11 Mar 2025 10:00:13 GMT

Try looking in $SPLUNK_HOME/etc/users/USERNAME/APPNAME/history/ for the history files for a user, typically you'll want to check in the search app if this is the default for the user.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Search History

kiran_panchavat — Tue, 11 Mar 2025 11:09:43 GMT

@SeoaneR

see this answer https://community.splunk.com/t5/Splunk-Search/How-to-clear-search-history/m-p/392454/highlight/true

Each user has it's own private search history.
Try finding it at the following path
/opt/splunk/etc/users/<nameofuser>/search/
Open the CSV file and manually remove the entries you no longer need.
Save the file after making changes.
You can delete the entire CSV file to clear all search history for a specific user.

If you need to delete specific events from your Splunk data, you can use the delete command in your search query. For example:

index=web_app status=505 | delete

This will remove events matching the specified criteria

Removing data by using delete command in Splunk SPL Query | Splunk

Re: Search History

livehybrid — Tue, 11 Mar 2025 13:52:11 GMT

Hi @SeoaneR

Just to clarify, you're looking for delete search history in the "Search History" dropdown on the front page of the search view? If so please see my other response, and be mindful of other responses in this thread which point to the "delete" command which may delete data in your indexes!!

Ultimately:

Try looking in $SPLUNK_HOME/etc/users/USERNAME/APPNAME/history/ for the history files for a user, typically you'll want to check in the search app if this is the default for the user.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Search History

SeoaneR — Tue, 11 Mar 2025 20:26:18 GMT

That was very useful , many thanks

It has shrunk my search history considerable and beginning to look more manageable.

Re: Search History

SeoaneR — Thu, 13 Mar 2025 16:20:07 GMT

Hi Will

Thanks for coming back to me .

I followed an instruction from another use about going into /opt/splunk/etc/users/admin/search/history

I then opened a .csv file under my name with vim and started to delete entries.

This has reduced the amount of searches from the "Search History" window pane in the User Interface of splunk.

Re: Search History

kiran_panchavat — Fri, 14 Mar 2025 05:07:55 GMT

@SeoaneR Great! I hope this is helpful for you. If so, please accept the solution.