Where does Splunk store the history of searches that were run?

[pramit46]

I'm trying to find out if splunk stores the searches in a log file. I know |history shows the list of queries, but it does not show the file name. Can any let me know if there is any physical file that splunk stores the history in?

[treywebb]

This article also address querying for search history across users: http://answers.splunk.com/answers/151378/why-history-command-only-shows-my-searches-not-searches-run...

[Flynt · Accepted solution]

Try looking in $SPLUNK_HOME/etc/users/USERNAME/APPNAME/history/ for the history files for a user.

Where USERNAME is the name of the user you want to see files for and APPNAME is the app context the user searched in.