https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371319#M109283 <P>Stopping and starting the Windows service or the Linux daemon would work.</P> <P>This will also work:<BR /> $SPLUNK_HOME/bin/splunk restart</P> Wed, 14 Feb 2018 00:43:32 GMT gjanders 2018-02-14T00:43:32Z https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371316#M109280 <P>I am trying to copy the search history (not the saved searches) from my old computer to the new one. </P> <P>I found CSV files containing all the search history of a Splunk user (in Windows environment): </P> <P>C:\Program Files\Splunk\etc\users\admin\search\history </P> <P>Let's assume that the old computer's searches are inside "old.csv" and the new computer's searches are in "new.csv". I tried concatenating "new.csv" with the entries of "old.csv". Splunk sees only the entries from "new.csv" and reverts "new.csv" to its automatically generated version (so that only the searches from the new computer are there). </P> <P>I tried substituting "old.csv" with "new.csv" and renaming "new.csv" to the name of "old.csv". Again, Splunk reverts to the original "new.csv". </P> <P>In the directory "C:\Program Files\Splunk\etc\users\admin\search\metadata" there is a file "local.meta": </P> <P>[history/.dummy_history]<BR /> version = 7.0.2<BR /> modtime = 1517937609.995129100</P> <P>[ui-tour/search-tour]<BR /> version = 7.0.2<BR /> modtime = 1517937609.996605600</P> <P>[ui-prefs/search]<BR /> version = 7.0.2<BR /> modtime = 1518105949.173788200</P> <P>I tried editing the modtimes in various ways corresponding to the times in the CSV-file but this does not have a noticeable effect. </P> <P>I assume that Splunk has a place for keeping track of search history that is not the file in the directory "history" of the corresponding user. However, I have only Fund1 and I am not aware of Splunk's internals. </P> <P>Please tell me how I can take the search history of one machine and add it to the search history of another one. Additionally, this is a feature suggestion. </P> Fri, 09 Feb 2018 07:29:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371316#M109280 vader_akbarhan 2018-02-09T07:29:48Z https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371317#M109281 <P>Are you shutting down the Splunk instance before modifying the (new) Splunk instances search history file?</P> Sat, 10 Feb 2018 22:02:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371317#M109281 gjanders 2018-02-10T22:02:14Z https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371318#M109282 <P>About shutting down the Splunk instance -- I am simply closing the browser where I have a session in Splunk. <BR /> How should I shut the instance down? (This was not covered in Fund. I.) Would stopping and starting its Windows/Linux deamon do it? I guess there is a better way to restart an instance. </P> Tue, 13 Feb 2018 12:40:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371318#M109282 vader_akbarhan 2018-02-13T12:40:20Z https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371319#M109283 <P>Stopping and starting the Windows service or the Linux daemon would work.</P> <P>This will also work:<BR /> $SPLUNK_HOME/bin/splunk restart</P> Wed, 14 Feb 2018 00:43:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-move-search-history/m-p/371319#M109283 gjanders 2018-02-14T00:43:32Z