topic How do I find out how many times an offensive search ran in the past day/week? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-find-out-how-many-times-an-offensive-search-ran-in-the/m-p/253552#M75871 <P>We have, what we believe to be an offensive search. How can we find out how many times it ran recently and by whom? </P> Wed, 25 Jan 2017 18:30:04 GMT ddrillic 2017-01-25T18:30:04Z How do I find out how many times an offensive search ran in the past day/week? https://community.splunk.com/t5/Splunk-Search/How-do-I-find-out-how-many-times-an-offensive-search-ran-in-the/m-p/253552#M75871 <P>We have, what we believe to be an offensive search. How can we find out how many times it ran recently and by whom? </P> Wed, 25 Jan 2017 18:30:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-out-how-many-times-an-offensive-search-ran-in-the/m-p/253552#M75871 ddrillic 2017-01-25T18:30:04Z Re: How do I find out how many times an offensive search ran in the past day/week? https://community.splunk.com/t5/Splunk-Search/How-do-I-find-out-how-many-times-an-offensive-search-ran-in-the/m-p/253553#M75872 <P>Is it a saved search or adhoc search?? If saved search, look at <CODE>index=_internal sourcetypes=scheduler savedsearch_name=YourSearchName</CODE>. For adhoc searches, check <CODE>index=_audit</CODE>.</P> Wed, 25 Jan 2017 18:34:12 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-out-how-many-times-an-offensive-search-ran-in-the/m-p/253553#M75872 somesoni2 2017-01-25T18:34:12Z Re: How do I find out how many times an offensive search ran in the past day/week? https://community.splunk.com/t5/Splunk-Search/How-do-I-find-out-how-many-times-an-offensive-search-ran-in-the/m-p/253554#M75873 <P>Gorgeous !!! </P> Wed, 25 Jan 2017 18:49:31 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-out-how-many-times-an-offensive-search-ran-in-the/m-p/253554#M75873 ddrillic 2017-01-25T18:49:31Z