Quick question: how can I view a user's search history?
The solution for 5.x and later is to use the "history" command in search. Ie.
| history
See http://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/History
Also, "history" suffers from the same problem as the "Jobs" page: it doesn't contain the full history. Viewing a dashboard with an auto-refresh can quickly blow through all the history that is retained for "history".
It appears that "history" only returns search history for the current user. Is there a way in 5.x to get history for all users?
