Splunk® Enterprise

Search Manual

Download manual as PDF

Download topic as PDF

Search history

There are several ways to view your search history.

Search history in the Search Summary view

Your full search history appears at the bottom of the Search Summary view.

Use the Search History panel to view and interact with the searches that you have run previously.

Click Expand your search history to view your search history. The search history displays as a table with the following columns:

Search
Contains the search string, displayed as plain text so that you can copy the contents. By default, the Search History table truncates the search string to fit on a single line. For longer search strings, you can click the expand icon to the left of the search string to display the full search string.
Actions
Contains the action, Add to search. Click Add to Search to replace the contents of the search bar with the selected historical search contents. You can use keyboard shortcuts to display the search in a new browser tab.
Windows: Use CTRL+ click on Add to Search
Mac: Use Command + click on Add to Search
Last Run
Contains the date and time when the search was last run.

Filter to locate searches

You can filter your search history to quickly find the search that you are looking for. You can filter by keyword or filter by time.

  • Type keywords into the filter text box to locate historical searches that contain the keyword. For example, type sourcetype=access_* to locate the searches that contain this criteria.
  • Select from the list of time filters based on when the search was last run. Select either Today, Last 7 Days, or Last 30 Days. To see the entire search history, select No Time Filter.

Sort search history

In the Search History table, click the Search column header to sort the searches alphabetically by search criteria. Click the Last Run column heading to sort the searches by the date that the search was run. You can sort the list in ascending or descending order by clicking the column heading again.

Change the page display

By default, the search history shows your most recent 20 searches. Subsequent pages show older searches. Click 20 Per Page to change how many searches appear on each page in the search history list. Choose from 10, 20, or 50 searches to display on each page.

Search history with the Search Assistant

Additionally, as you type search criteria into the Search bar, the Search Assistant shows searches from your history as a possible Matching Search to the criteria you are typing in.

See Also

Navigating Splunk Web

PREVIOUS
Search modes
  NEXT
Search command primer

This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.2.0, 7.2.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters