If you want to know who ran what searches, and how many times, you could start with something like this:
index=_audit user=* action=search search=* sourcetype=audittrail | stats count(user) by search, user
If my comment helps, please give it a thumbs up!
