https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657606#M227136 <P>This is not working at all, We will get all the searches running in splunk. because there is no keyword to identify whether search is savedsearch or&nbsp;Ad-hoc search or Reports.&nbsp;</P> Thu, 14 Sep 2023 12:59:22 GMT harishsplunk7 2023-09-14T12:59:22Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657220#M226999 <P>I need to get the&nbsp; list of Adhoc Searches and Saved search running by user in Audit logs.</P><P>how to differentiate these searches in _audit logs, is there any specific keyword to identify the searches&nbsp;</P> Mon, 11 Sep 2023 15:25:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657220#M226999 harishsplunk7 2023-09-11T15:25:43Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657419#M227074 <P>Searches are in the audit log.&nbsp; Saved searches will have a non-empty value in the savedsearch_name field.&nbsp; The user name is in the user field.</P><LI-CODE lang="markup">index=_audit action=search | table user savedsearch_name search</LI-CODE> Wed, 13 Sep 2023 12:24:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657419#M227074 richgalloway 2023-09-13T12:24:39Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657606#M227136 <P>This is not working at all, We will get all the searches running in splunk. because there is no keyword to identify whether search is savedsearch or&nbsp;Ad-hoc search or Reports.&nbsp;</P> Thu, 14 Sep 2023 12:59:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657606#M227136 harishsplunk7 2023-09-14T12:59:22Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657609#M227139 <P>As stated in my response, a saved search will have a non-empty value in the savedsearch_name field (keyword).&nbsp; If <FONT face="courier new,courier">savedsearch_name=""</FONT> then the search is ad-hoc.</P> Thu, 14 Sep 2023 13:04:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-list-of-Adhoc-Search-and-Saved-search-running-by/m-p/657609#M227139 richgalloway 2023-09-14T13:04:27Z