Search history

Your search history appears in both the Search Summary view and the New Search view. In the Search Summary view, the history appears at the bottom of the view in the Search History panel. In the New Search view, the history appears as part of the Search Assistant.

In the Search Summary view, use the Search History panel to view and interact with the searches that you have run previously.

1. To view the Search History panel, click Search in the Apps bar. The Search Summary view opens, which is the landing page for Splunk Search.
2. Under Search History, click Expand your search history to view your search history. Your search history displays as a table with the following columns:

• Search: Contains the search string, displayed as plain text so that you can copy the contents. By default, the Search History table truncates the search string to fit on a single line. For longer search strings, you can click the expand icon to the left of the search string to display the full search string.
• Actions: Contains the action, Add to search. Click Add to Search to replace the contents of the search bar with the selected historical search contents. Command-click Add to Search to open the search in a new tab.
• Last Run: Contains the date and time when the search was last run.

You can interact with your Search History in the following ways:

• Filter with keywords: Use the filter bar to run keyword searches against the text of your historical searches.
• Filter by time: Select from the list of time filters based on when the search was written and last run. You can display the search history with No Time Filter or select from a list of predefined time filters: Today, Last 7 Days, and Last 30 Days.
• Sort table contents: Click the column headers for Search or Last Run to sort the table results.

See Also

Navigating Splunk Web