create a report which includes saved searches, rest api serarches and adhoc searches

[srinivasup]

create a report which includes saved searches, rest api serarches and adhoc searches

[somesoni2]

Give this a try

index=_audit sourcetype=audittrail action=search info=granted | eval type=case(like(search_id,"'scheduler_%"),"scheduled search",extra_fields="'*'","adhoc-search",1=1,"RestAPI search") | stats dc(search_id) as count by type

[woodcock]

You need to explore the REST API; start here:
https://www.splunk.com/blog/2008/03/03/exploring-splunks-rest-api.html

[srinivasup]

From last 24 hrs, how many adhoc searches, saved searches and Rest searches are invoked.

Want to get logs from internal logs,