How to audit REST api initiated searches?

[the_wolverine]

I'm looking to audit REST API search activity and I'm unable to locate any logging of REST API initiated searches. I just need to know what queries are being run and by whom.

[somesoni2 · Accepted solution]

Following query provides list of all the searches being executed by all the users (including scheduled searches and REST API searches

index=_audit action="search" search="*"

Further, you can differentiate Scheduled searches with adhoc searches using following:

|eval adhoc=if(NOT user="splunk-system-user",1,0) | eval schd=if(user="splunk-system-user",1,0)

[the_wolverine]

We have a case where they are not being logged so I'm going to track it down. Thanks for your response.