Splunk Search

history command Catch 22

topdeck
Explorer

Try:

history type=ah action=settle

I get this helpful hint:

"Note: Your first search term is also a search command. Did you mean " | history"?"

Okay Splunk, thanks for the tip.

I'll try:

type=ah action=settle | history

"Error in 'history' command: This command must be the first command of a search."

What in the blue hell is going on here? I did a search yesterday and I can't remember what it was, and before you ask, I don't have access to the box Splunk runs on so I can't look at the logs.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee
| history | where search LIKE "%ah%"

or

| history | eval _raw=search | search "type=ah"
0 Karma

sideview
SplunkTrust
SplunkTrust

The first message is telling you that there is a 'history' command,

and the second message, may not make much sense if you've never seen it before, but it means that you have to do this:

| history type=ah action=settle

where the pipe character is literally at the beginning of the search. History is what they call a "generating" command.

However if you're trying to actually search for the word "history", then you don't want the history command.

topdeck
Explorer

Thank you, this was almost the answer.

| history

Returns all of my searches but I can't seem to filter them. Doing something like:

| history type=ah

Results in "Error in 'history' command: Invalid argument: 'type=ah'"

I also tried

| history | type=ah

or

| history | search type=ah

It doesn't like that.

| history | search ah

Does work, it's ugly but at least it's something.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...