Splunk® Enterprise

Search Manual

Search history

There are several ways to view your search history for searches that you have previously run.

The search history is available only for the app you're currently using. For example, if you run a search in another Splunk app, the search history for that app will not be visible in the search history in the Search app.

Search history in the Search Summary view

Your full search history appears at the bottom of the Search Summary view.

Use the Search History panel to view and interact with the searches that you have previously run.

Click the greater than ( > ) symbol to expand the display to view your search history. The search history displays as a table with the following columns:

Search
Contains the search string, displayed as plain text so that you can copy the contents. By default, the Search History table truncates the search string to fit on a single line. For longer search strings, you can click the expand icon to the left of the search string to display the full search string.
Actions
Contains the action, Add to search. Click Add to Search to replace the contents of the search bar with the selected historical search contents.
You can use keyboard shortcuts to display the search in a new browser tab.
Windows: Use CTRL+ click on Add to Search
Mac: Use Command + click on Add to Search
Last Run
Contains the date and time when the search was last run.

Filter to locate searches

You can filter your search history to quickly find the search that you are looking for. You can filter by keyword or filter by time.

  • Type keywords into the filter text box to locate historical searches that contain the keyword. For example, type sourcetype=access_* to locate the searches that contain this criteria.
  • Select from the list of time filters based on when the search was last run.

Sort search history

In the Search History table, click the Search column header to sort the searches alphabetically by search criteria. Click the Last Run column heading to sort the searches by the date that the search was run. You can sort the list in ascending or descending order by clicking the column heading again.

Change the page display

By default, the search history shows your most recent 20 searches. Subsequent pages show older searches. Click 20 Per Page to change how many searches appear on each page in the search history list. Choose from 10, 20, or 50 searches to display on each page.

Search history with the Search Assistant

Additionally, as you type search criteria into the Search bar, the Search Assistant shows searches from your history as a possible Matching Search to the criteria you are typing in.

Search history with keyboard navigation

You can also use these keyboard shortcuts to scroll through the last 100 searches in your search history.

Action Linux or Windows Mac OSX
Scroll to the previous search. Alt + P Ctrl + P
Scroll to the next search. Alt + N Ctrl + N

See Also

Navigating Splunk Web
About the Search app
Last modified on 12 August, 2024
Search modes   Search command primer

This documentation applies to the following versions of Splunk® Enterprise: 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters