https://community.splunk.com/t5/Monitoring-Splunk/audit-index-assistance/m-p/443739#M6254 <P>If you want to know who ran what searches, and how many times, you could start with something like this:</P> <P><CODE>index=_audit user=* action=search search=* sourcetype=audittrail | stats count(user) by search, user</CODE></P> Mon, 18 Mar 2019 17:52:36 GMT nickhills 2019-03-18T17:52:36Z https://community.splunk.com/t5/Monitoring-Splunk/audit-index-assistance/m-p/443738#M6253 <P>Does anyone know how to setup a stats table for the _audit with all data in that index? Mainly listing all the data in the index that contain searched data or event a sample of searches you performed. Please help.</P> Mon, 18 Mar 2019 17:32:19 GMT https://community.splunk.com/t5/Monitoring-Splunk/audit-index-assistance/m-p/443738#M6253 reneedeleon 2019-03-18T17:32:19Z https://community.splunk.com/t5/Monitoring-Splunk/audit-index-assistance/m-p/443739#M6254 <P>If you want to know who ran what searches, and how many times, you could start with something like this:</P> <P><CODE>index=_audit user=* action=search search=* sourcetype=audittrail | stats count(user) by search, user</CODE></P> Mon, 18 Mar 2019 17:52:36 GMT https://community.splunk.com/t5/Monitoring-Splunk/audit-index-assistance/m-p/443739#M6254 nickhills 2019-03-18T17:52:36Z