I just did a clean installation of splunk on my windows7 64bit workstation.
why is search history not showing up while I do searches?
if you do ... | history do you see anything?
... | history
all user search history is written in index=_audit
This is a known bug SPL-42931 in 4.2.3. This will be fixed in 4.2.4.
fixed in 4.2.4
View solution in original post