What reasons could cause a user to lose their Splunk search history?

[brent_weaver]

I have a user that lost his search history in Splunk search. Any ideas why? I did not lose mine but he did?!?!

[mydog8it]

Your Search History is presented in the app you used to launch the Search. I have a default app that is created for my users and search is available to them in that app. The Search History that accumulates in that app does not propagate to other apps. So if the user navigates outside of their default app and lunches search from that location their history is not available to them that was "learned" in the default app.

Hope this helps...

[pruthvikrishnap]

Hi,

Try using the |history command, please find the complete details in this link
https://docs.splunk.com/Documentation/Splunk/5.0.5/SearchReference/History

if that doesnt work try below search:
index=_internal user=* sourcetype=splunkd_ui_access | dedup q | table _time, q | eval q=urldecode(q)