create a report which includes saved searches, rest api serarches and adhoc searches
Give this a try
index=_audit sourcetype=audittrail action=search info=granted | eval type=case(like(search_id,"'scheduler_%"),"scheduled search",extra_fields="'*'","adhoc-search",1=1,"RestAPI search") | stats dc(search_id) as count by type
You need to explore the REST API; start here: https://www.splunk.com/blog/2008/03/03/exploring-splunks-rest-api.html
From last 24 hrs, how many adhoc searches, saved searches and Rest searches are invoked.
Want to get logs from internal logs,
