https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277836#M83816 <P>I upgraded to Splunk 6.3 and it's working beautifully, however, I no longer get "matching terms" as I type in the search box.</P> <P>In previous versions of Splunk, if I typed: <CODE>err</CODE> in the search box, I would see error=300, errors=402, errored=23 as typehead matching terms. Now I only see the term error show up in "matching search". There seems to be no matching term as you search now? I have auto-open turned on the search assistant.</P> Tue, 20 Oct 2015 21:25:54 GMT rroberts 2015-10-20T21:25:54Z https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277836#M83816 <P>I upgraded to Splunk 6.3 and it's working beautifully, however, I no longer get "matching terms" as I type in the search box.</P> <P>In previous versions of Splunk, if I typed: <CODE>err</CODE> in the search box, I would see error=300, errors=402, errored=23 as typehead matching terms. Now I only see the term error show up in "matching search". There seems to be no matching term as you search now? I have auto-open turned on the search assistant.</P> Tue, 20 Oct 2015 21:25:54 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277836#M83816 rroberts 2015-10-20T21:25:54Z https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277837#M83817 <P>This may be related to your <CODE>history</CODE> on that Search Head which should be here:</P> <PRE><CODE>$SPLUNK_HOME/etc/users/&lt;YourUserName&gt;/search/history/&lt;YourSearchHead&gt;.csv </CODE></PRE> <P>It seems that something during your upgrade damaged/deleted this file but perhaps you can restore it from your backup. You did make a backup of your Search Head before you upgraded, didn't you?</P> <P>Also, as the file location implies, you have a different search history depending on which app (context) you have when you search. It is possible that either you are searching from within a different app. This is common when some apps are removed during the upgrade process.</P> Tue, 20 Oct 2015 21:39:07 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277837#M83817 woodcock 2015-10-20T21:39:07Z https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277838#M83818 <P>These are "matching terms" not matching previous searches. Shouldnt they be fetched from the index? In 6.2 I can see ..DEBUG SearchOperator: Typeahead ....loadtermsfromlex. In 6.3 when I put the SearchOperator:Typeahead in debug mode I dont see this "loadtermsfromlex" occurring. Also, to answer your question. I see my searchhead.csv file and it looks fine.</P> Tue, 20 Oct 2015 21:52:00 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277838#M83818 rroberts 2015-10-20T21:52:00Z https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277839#M83819 <P>It looks like this bug has already been reported to engineering as:<BR /> SPL-93222<BR /> SPL-96621</P> Wed, 21 Oct 2015 14:28:05 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-search-typeahead-no-longer-show-quot-matching-terms/m-p/277839#M83819 rroberts 2015-10-21T14:28:05Z