Skip to content

Instantly share code, notes, and snippets.

@faststeak

faststeak/Splunk search to search your past searches

Created March 28, 2018 14:54
Show Gist options
  • Save faststeak/2550f17e6c35ad0bf9bd943d4ea35a3a to your computer and use it in GitHub Desktop.
Save faststeak/2550f17e6c35ad0bf9bd943d4ea35a3a to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Splunk search to search your past searches
## Note: This particular search has just about every character as you type it. It takes some scrolling to find the actual search you ran. When I find a better way, I'll update this.
index=_internal user=<your splunk user here> sourcetype=splunkd_ui_access search=* | eval search=urldecode(search) | stats count by user search
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment