How to get a list of reports and searches run by a specific user?

[a212830]

Hi,

I need a report that shows what searches and scheduled reports that a user has run over a timeframe. I thought it was in the DMC, but I don't see it. Can someone help me?

[sloshburch]

Manage search jobs may also be of interest given the formatting and filtering already implemented for you.

[solarboyz1]

Except......that report will only contain the jobs that haven't expired. Its based on the artifacts in the dispatch directory I believe. To get historic data, you would need to use logs.

[solarboyz1 · Accepted solution]

index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " | history" NOT "AUTOSUMMARY" | table _time, user, search

You can reduce that to a specific user:

index=_audit action=search search=* NOT "typeahead" NOT metadata NOT " user=${user_of_interest} | history" NOT "AUTOSUMMARY" | table _time,  search

[solarboyz1]

Correct a terrible paste accident in the "specific user" search syntax above:

index=_audit action=search search=* user=${user_of_interest} NOT "typeahead" NOT metadata NOT " | history" NOT "AUTOSUMMARY" | table _time, search

[a212830]

thanks!