https://community.splunk.com/t5/Splunk-Dev/user-request-in-splunk-servers/m-p/452791#M8231 <P>Surely you are joking about your numbers. In any case, try this:</P> <PRE><CODE>index=_* sourcetype=audittrail action=search | stats count BY user host | sort 0 - count | stats list(*) AS * BY user </CODE></PRE> Fri, 10 May 2019 18:23:58 GMT woodcock 2019-05-10T18:23:58Z https://community.splunk.com/t5/Splunk-Dev/user-request-in-splunk-servers/m-p/452790#M8230 <P>Hi ,</P> <P>i have more that 22 SH and 18 indexers<BR /> i want to know the how may request are coming to each search head and indexer</P> <P>Can someone help me with basic query for this</P> Fri, 10 May 2019 17:40:35 GMT https://community.splunk.com/t5/Splunk-Dev/user-request-in-splunk-servers/m-p/452790#M8230 sravankaripe 2019-05-10T17:40:35Z https://community.splunk.com/t5/Splunk-Dev/user-request-in-splunk-servers/m-p/452791#M8231 <P>Surely you are joking about your numbers. In any case, try this:</P> <PRE><CODE>index=_* sourcetype=audittrail action=search | stats count BY user host | sort 0 - count | stats list(*) AS * BY user </CODE></PRE> Fri, 10 May 2019 18:23:58 GMT https://community.splunk.com/t5/Splunk-Dev/user-request-in-splunk-servers/m-p/452791#M8231 woodcock 2019-05-10T18:23:58Z