Preserve search queries by the querystring

[Tom]

If I close my web browser with search results up, then on restart of the web browser I end up at the "flashtimeline" page again, but with no Search query up. Is there a way to run searches with the search itself in the querystring so that I don't lose the search on restart?

My browser just crashed while I was in the middle of testing a rather large query, causing me to lose all of my work 😞

[sideview]

The best thing to do when you have a search you want to keep around for a while, is to click

Actions > Get link to results.

That will both

a) save the results permanently on disk and

b) give you a nice URL to get those results back in the future.

As such it basically does the same thing as clicking 'Send to background', except that since you have the URL you wont have to dig around for it later in the Job Manager.

And you can even click 'get link to results' while the search is running.

[sideview]

Well if you cant save any results on disk then you have a deeper problem because Splunk deletes all unsaved jobs after only 15 minutes.
Each one doesnt take up a lot of space although I'll admit that once you start saving them they can pile up rather quickly.

[Tom]

That doesn't help, because the variety of searches I'm looking for are too large for my allowed space usage, so I can't save anything. I would like to be able to use my browsers standard facilities instead of forcing any server-side activity.

[Lowell]

Yeah, that's annoying. You can always "save" your searches while they are running. You can do this either from the jobs manager page, or by clicking the "send to background" link. Either way, you can get your job back by going back into the job manager page, even if your browser crashed. You will have to remember to delete the job later if you don't want to keep it around.

But after the fact, the best advice I can give is to go search your internal index for your previous search:

index=_internal source=*searches.log YourUserName | rex "(?s)\S+ \S+ - (?<user>\S+)\t(?<search>.*)$" | dedup search

This should give you a quick list of your previous searches. You can copy and paste your search from there. Don't forget to remove the leading search command from the begining of your search.

(BTW, I do this often enough I added the above regex to my props.conf file.)