How to move search history?

[vader_akbarhan]

I am trying to copy the search history (not the saved searches) from my old computer to the new one.

I found CSV files containing all the search history of a Splunk user (in Windows environment):

C:\Program Files\Splunk\etc\users\admin\search\history

Let's assume that the old computer's searches are inside "old.csv" and the new computer's searches are in "new.csv". I tried concatenating "new.csv" with the entries of "old.csv". Splunk sees only the entries from "new.csv" and reverts "new.csv" to its automatically generated version (so that only the searches from the new computer are there).

I tried substituting "old.csv" with "new.csv" and renaming "new.csv" to the name of "old.csv". Again, Splunk reverts to the original "new.csv".

In the directory "C:\Program Files\Splunk\etc\users\admin\search\metadata" there is a file "local.meta":

[history/.dummy_history]
version = 7.0.2
modtime = 1517937609.995129100

[ui-tour/search-tour]
version = 7.0.2
modtime = 1517937609.996605600

[ui-prefs/search]
version = 7.0.2
modtime = 1518105949.173788200

I tried editing the modtimes in various ways corresponding to the times in the CSV-file but this does not have a noticeable effect.

I assume that Splunk has a place for keeping track of search history that is not the file in the directory "history" of the corresponding user. However, I have only Fund1 and I am not aware of Splunk's internals.

Please tell me how I can take the search history of one machine and add it to the search history of another one. Additionally, this is a feature suggestion.

[gjanders]

Are you shutting down the Splunk instance before modifying the (new) Splunk instances search history file?

[vader_akbarhan]

About shutting down the Splunk instance -- I am simply closing the browser where I have a session in Splunk.
How should I shut the instance down? (This was not covered in Fund. I.) Would stopping and starting its Windows/Linux deamon do it? I guess there is a better way to restart an instance.

[gjanders]

Stopping and starting the Windows service or the Linux daemon would work.

This will also work:
$SPLUNK_HOME/bin/splunk restart