Security

Preserve search queries by the querystring

Tom
Engager

If I close my web browser with search results up, then on restart of the web browser I end up at the "flashtimeline" page again, but with no Search query up. Is there a way to run searches with the search itself in the querystring so that I don't lose the search on restart?

My browser just crashed while I was in the middle of testing a rather large query, causing me to lose all of my work 😞

Tags (1)

sideview
SplunkTrust
SplunkTrust

The best thing to do when you have a search you want to keep around for a while, is to click

Actions > Get link to results.

That will both

a) save the results permanently on disk and

b) give you a nice URL to get those results back in the future.

As such it basically does the same thing as clicking 'Send to background', except that since you have the URL you wont have to dig around for it later in the Job Manager.

And you can even click 'get link to results' while the search is running.

0 Karma

sideview
SplunkTrust
SplunkTrust

Well if you cant save any results on disk then you have a deeper problem because Splunk deletes all unsaved jobs after only 15 minutes.
Each one doesnt take up a lot of space although I'll admit that once you start saving them they can pile up rather quickly.

0 Karma

Tom
Engager

That doesn't help, because the variety of searches I'm looking for are too large for my allowed space usage, so I can't save anything. I would like to be able to use my browsers standard facilities instead of forcing any server-side activity.

0 Karma

Lowell
Super Champion

Yeah, that's annoying. You can always "save" your searches while they are running. You can do this either from the jobs manager page, or by clicking the "send to background" link. Either way, you can get your job back by going back into the job manager page, even if your browser crashed. You will have to remember to delete the job later if you don't want to keep it around.

But after the fact, the best advice I can give is to go search your internal index for your previous search:

index=_internal source=*searches.log YourUserName | rex "(?s)\S+ \S+ - (?<user>\S+)\t(?<search>.*)$" | dedup search

This should give you a quick list of your previous searches. You can copy and paste your search from there. Don't forget to remove the leading search command from the begining of your search.

(BTW, I do this often enough I added the above regex to my props.conf file.)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...