Splunk Search

Can I do undo for search key words in Splunk 6?

melonman
Motivator

Hi there,

I remember I could do undo by pressing command+Z in OSX to go back to the previous search term in Splunk 5.
Now I am using Splunk6, but the feature is not working.

Does anyone know how to do undo in Splunk 6?
Has this feature been removed???

Thanks,

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

As of Splunk 6 the Ctrl-X or Cmd-Z "Undo" action will only undo the keypresses you have typed since the last time you hit return. Once you hit return that history gets wiped and to return to the moment you hit Return, you have to use your browsers back button. And as you have found out, the browser's back button will redispatch that search.

The only advice that I have, is that you can just wail away on the back button and forward buttons and let the crazy storm of search dispatches happen - the UI will be working very hard to cancel the one(s) that you dispatched moments before, but it will cancel them. Which just means you shouldn't worry about creating a lot of runaway searches on the host. It is frustrating though because the old behavior was much better and you could Ctrl-Z your way back with great precision and without any searches being dispatched until you hit return. I submitted this as an ER myself a ways back.

And one final comment that may help, is that the Sideview Utils app does have a little sample interface that is a partial replacement for the generic search UI - with a relatively recent version of Sideview Utils you can navigate to "Apps > Sideview Utils > Sample Interfaces > Sideview Search, or just send your browser to /en-US/app/sideview_utils/sv_search
If you don't have that view in your copy of Sideview Utils just update to the latest (3.3 as of this writing)

View solution in original post

sideview
SplunkTrust
SplunkTrust

As of Splunk 6 the Ctrl-X or Cmd-Z "Undo" action will only undo the keypresses you have typed since the last time you hit return. Once you hit return that history gets wiped and to return to the moment you hit Return, you have to use your browsers back button. And as you have found out, the browser's back button will redispatch that search.

The only advice that I have, is that you can just wail away on the back button and forward buttons and let the crazy storm of search dispatches happen - the UI will be working very hard to cancel the one(s) that you dispatched moments before, but it will cancel them. Which just means you shouldn't worry about creating a lot of runaway searches on the host. It is frustrating though because the old behavior was much better and you could Ctrl-Z your way back with great precision and without any searches being dispatched until you hit return. I submitted this as an ER myself a ways back.

And one final comment that may help, is that the Sideview Utils app does have a little sample interface that is a partial replacement for the generic search UI - with a relatively recent version of Sideview Utils you can navigate to "Apps > Sideview Utils > Sample Interfaces > Sideview Search, or just send your browser to /en-US/app/sideview_utils/sv_search
If you don't have that view in your copy of Sideview Utils just update to the latest (3.3 as of this writing)

guilhem
Contributor

I have installed chrome 31.0.1650.57 and the problem still happen.

It looks like the problem is rerunning a search and trying to hit CTR Z afterwards. The history of undo seems to have gone away. Very frustrating.

0 Karma

guilhem
Contributor

I am running mac OSX 10.8.4 and chrome 26.0.1410.65. This feature used to work in splunk 4.3 but now it's not working anymore.

I really need it! Does anybody has a solution?

0 Karma

emiller42
Motivator

this is working fine for me on Splunk 6 in Chrome (29.0.1547.76) on OSX (10.8.5)

0 Karma

melonman
Motivator

I need this feature, and I don't want to run previous searches again and again just to go back to previous searches by clicking browser's back button ...

Ayn
Legend

Also noticed this - annoying!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...