User has less entries in Search History. Sometime no Search History at all.

Applicability

Splunk Enterprise Splunk Cloud

Description

One user is missing his search entries in 'Search History'
We can see 10 unique SPL search strings. 


But from the above screenshot, we only see 3 entries in the 'Search History', 7 search entries were missing.
 

Investigation

This is SPL used for displaying results for “Search History”:

| history | search NOT search="| history*" AND NOT search="*metadata*" AND NOT search="*loadjob*" AND NOT savedsearch_name="*" AND NOT search="search" AND NOT search="*from sid*" AND NOT search="| eventcount summarize=false index=* index=_**" AND NOT provenance="UI:LocateData" AND NOT provenance="UI:TableEditor" AND NOT provenance="UI:DataModel" AND NOT provenance="UI:Pivot" AND NOT provenance="UI:Dataset" | dedup search | head 100000

For this case, it is about this field “NOT savedsearch_name="*" “.

This means in “Search History” only displays the searches which don’t have the savedsearch_name. 
But if we check the file “ausignrymon005p.csv” for the user “sitsgw”, we can see only few of them don’t have the savedsearch_name:

 While most of them have the savedsearch_name like search1, search2…

These searches with the savedsearch_name won’t display under ‘Search History’. 

That’s the reason why user ‘sitsgw’ doesn’t have much under his ‘Search History’.

Resolution

Why these searches have the savedsearch_name is because these searches are defined in $SPLUNK_HOME/etc/apps/search/local/data/ui/views/perimetre_status.xml
I assume the scenario for user ‘sitsgw’ is he/she keeps refreshing/monitoring the dashboard ‘Perimeter_Status’ causing the 6 searches defined in this dashboard keep running all the time.
This behavior will fill up the file “ausignrymon005p.csv” which contains 1000 entries. 

Related Links

https://jira.splunk.com/browse/SPL-212845

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release