https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388387#M6615 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/SupervisejobswiththeJobspage">Manage search jobs</A> may also be of interest given the formatting and filtering already implemented for you.</P> Wed, 20 Jun 2018 12:57:04 GMT sloshburch 2018-06-20T12:57:04Z https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388383#M6611 <P>Hi,</P> <P>I need a report that shows what searches and scheduled reports that a user has run over a timeframe. I thought it was in the DMC, but I don't see it. Can someone help me?</P> Tue, 19 Jun 2018 18:14:12 GMT https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388383#M6611 a212830 2018-06-19T18:14:12Z https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388384#M6612 <PRE><CODE>index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " | history" NOT "AUTOSUMMARY" | table _time, user, search </CODE></PRE> <P>You can reduce that to a specific user:</P> <PRE><CODE>index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " user=${user_of_interest} | history" NOT "AUTOSUMMARY" | table _time, search </CODE></PRE> Tue, 19 Jun 2018 18:32:06 GMT https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388384#M6612 solarboyz1 2018-06-19T18:32:06Z https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388385#M6613 <P>Correct a terrible paste accident in the "specific user" search syntax above:</P> <P>index=_audit action=search search=* user=${user_of_interest} NOT "typeahead" NOT metadata NOT " | history" NOT "AUTOSUMMARY" | table _time, search</P> Tue, 29 Sep 2020 20:05:58 GMT https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388385#M6613 solarboyz1 2020-09-29T20:05:58Z https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388386#M6614 <P>thanks!</P> Tue, 19 Jun 2018 18:47:29 GMT https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388386#M6614 a212830 2018-06-19T18:47:29Z https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388387#M6615 <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/SupervisejobswiththeJobspage">Manage search jobs</A> may also be of interest given the formatting and filtering already implemented for you.</P> Wed, 20 Jun 2018 12:57:04 GMT https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388387#M6615 sloshburch 2018-06-20T12:57:04Z https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388388#M6616 <P>Except......that report will only contain the jobs that haven't expired. Its based on the artifacts in the dispatch directory I believe. To get historic data, you would need to use logs. </P> Wed, 20 Jun 2018 13:45:43 GMT https://community.splunk.com/t5/Reporting/How-to-get-a-list-of-reports-and-searches-run-by-a-specific-user/m-p/388388#M6616 solarboyz1 2018-06-20T13:45:43Z