Splunk Search

What reasons could cause a user to lose their Splunk search history?


I have a user that lost his search history in Splunk search. Any ideas why? I did not lose mine but he did?!?!

0 Karma


Your Search History is presented in the app you used to launch the Search. I have a default app that is created for my users and search is available to them in that app. The Search History that accumulates in that app does not propagate to other apps. So if the user navigates outside of their default app and lunches search from that location their history is not available to them that was "learned" in the default app.

Hope this helps...



Try using the |history command, please find the complete details in this link

if that doesnt work try below search:
index=_internal user=* sourcetype=splunkd_ui_access | dedup q | table _time, q | eval q=urldecode(q)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!