Splunk® Enterprise

Search Manual

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.3 is no longer supported as of October 22, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Search history

There are several ways to view your search history.

Search history in the Search Summary view

Your full search history appears at the bottom of the Search Summary view.

Use the Search History panel to view and interact with the searches that you have run previously.

Click the greater than ( > ) symbol to expand the display to view your search history. The search history displays as a table with the following columns:

Search
Contains the search string, displayed as plain text so that you can copy the contents. By default, the Search History table truncates the search string to fit on a single line. For longer search strings, you can click the expand icon to the left of the search string to display the full search string.
Actions
Contains the action, Add to search. Click Add to Search to replace the contents of the search bar with the selected historical search contents.
You can use keyboard shortcuts to display the search in a new browser tab.
Windows: Use CTRL+ click on Add to Search
Mac: Use Command + click on Add to Search
Last Run
Contains the date and time when the search was last run.

This image shows the search history table..

Filter to locate searches

You can filter your search history to quickly find the search that you are looking for. You can filter by keyword or filter by time.

  • Type keywords into the filter text box to locate historical searches that contain the keyword. For example, type sourcetype=access_* to locate the searches that contain this criteria.
  • Select from the list of time filters based on when the search was last run. Select either Today, Last 7 Days, or Last 30 Days. To see the entire search history, select No Time Filter.

Sort search history

In the Search History table, click the Search column header to sort the searches alphabetically by search criteria. Click the Last Run column heading to sort the searches by the date that the search was run. You can sort the list in ascending or descending order by clicking the column heading again.

Change the page display

By default, the search history shows your most recent 20 searches. Subsequent pages show older searches. Click 20 Per Page to change how many searches appear on each page in the search history list. Choose from 10, 20, or 50 searches to display on each page.

Search history with the Search Assistant

Additionally, as you type search criteria into the Search bar, the Search Assistant shows searches from your history as a possible Matching Search to the criteria you are typing in.

See Also

Navigating Splunk Web

Last modified on 29 July, 2020
PREVIOUS
Search modes
  NEXT
Search command primer

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters