Splunk® Enterprise

Search Manual

Download manual as PDF

Download topic as PDF

Search history

Your search history appears in both the Search Summary view and the New Search view. In the Search Summary view, the history appears at the bottom of the view in the Search History panel. In the New Search view, the history appears as part of the Search Assistant.

In the Search Summary view, use the Search History panel to view and interact with the searches that you have run previously.

  1. To view the Search History panel, click Search in the Apps bar. The Search Summary view opens, which is the landing page for Splunk Search.
  2. Under Search History, click Expand your search history to view your search history. Your search history displays as a table with the following columns:
  • Search: Contains the search string, displayed as plain text so that you can copy the contents. By default, the Search History table truncates the search string to fit on a single line. For longer search strings, you can click the expand icon to the left of the search string to display the full search string.
  • Actions: Contains the action, Add to search. Click Add to Search to replace the contents of the search bar with the selected historical search contents. Command-click Add to Search to open the search in a new tab.
  • Last Run: Contains the date and time when the search was last run.

You can interact with your search history in the following ways:

  • Filter with keywords: Use the filter bar to run keyword searches against the text of your historical searches.
  • Filter by time: Select from the list of time filters based on when the search was written and last run. You can display the search history with No Time Filter or select from a list of predefined time filters: Today, Last 7 Days, and Last 30 Days.
  • Sort table contents: Click the column headers for Search or Last Run to sort the table results.


By default, the search history shows your most recent 20 searches. You can change how many searches appear on the search history list. The choices are 10, 20, or 50 searches for each page. In the Search Summary view, click 20 Per Page to make your selection.

See Also

Navigating Splunk Web

PREVIOUS
Search modes
  NEXT
Search command primer

This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters