Splunk Search

Get user's search history

Branden
Builder

Quick question: how can I view a user's search history?

Tags (2)

Glenn
Builder

The solution for 5.x and later is to use the "history" command in search. Ie.

| history

See http://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/History

joebensimo
Path Finder

Also, "history" suffers from the same problem as the "Jobs" page: it doesn't contain the full history. Viewing a dashboard with an auto-refresh can quickly blow through all the history that is retained for "history".

0 Karma

joebensimo
Path Finder

It appears that "history" only returns search history for the current user. Is there a way in 5.x to get history for all users?

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...