Splunk Search

Get user's search history

Branden
Builder

Quick question: how can I view a user's search history?

Tags (2)

mparks11
Path Finder

That's awesome! Glad you were able to find out, and thanks for sharing!

Glenn
Builder

The solution for 5.x and later is to use the "history" command in search. Ie.

| history

See http://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/History

joebensimo
Path Finder

Also, "history" suffers from the same problem as the "Jobs" page: it doesn't contain the full history. Viewing a dashboard with an auto-refresh can quickly blow through all the history that is retained for "history".

0 Karma

joebensimo
Path Finder

It appears that "history" only returns search history for the current user. Is there a way in 5.x to get history for all users?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...