In Analyze History, keyword search happens only on client-side. For any set of filters we sort the results by submit_time and get only the top 100 data-entries for the first load. If there is a keyword search, then we perform this search on first 100 loaded data-entries. To search next 100 records you have to click on "show more" button. This will fetch the next 100 data-entries and apply keyword search on this additional data-set.
SCENARIO 1 -> You apply a keyword and select "All Users"
In this case, the Search process will first filter out top 100 records (according to the submit time) and then will display the commands with matching keywords from the top 100 results on the UI.
You now click "SHOW MORE" button which will then filter out the next 100 records, filter out the commands with matching keyword and display it on UI.
SCENARIO 2 -> You apply a keyword and select only a specific user
In this case, the Search process will do the same thing but in case of just 1 specific user, so if the first 100 records have more number of commands with matching keywords for the specific user, it will display more number of commands on the UI.
For this to work as expected, please click 'show more' a few times until it loads the required number of commands. Then, clear existing filter, add the keyword, and click on 'apply'. It'll filter by keywords as expected.
This is the current behavior of Analyze History search feature. We are working on improving the search feature and make it faster using Elastic Search.