Splunk Search

Get user's search history

Branden
Builder

Quick question: how can I view a user's search history?

Tags (2)

mparks11
Path Finder

That's awesome! Glad you were able to find out, and thanks for sharing!

Glenn
Builder

The solution for 5.x and later is to use the "history" command in search. Ie.

| history

See http://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/History

joebensimo
Path Finder

Also, "history" suffers from the same problem as the "Jobs" page: it doesn't contain the full history. Viewing a dashboard with an auto-refresh can quickly blow through all the history that is retained for "history".

0 Karma

joebensimo
Path Finder

It appears that "history" only returns search history for the current user. Is there a way in 5.x to get history for all users?

Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...