How can I get the details about the queries run by user

[pradeepkumarg]

I want to know the details of the queries issued by users.

index=_internal sourcetype="searches"

This only gives me the search query and not earliest,latest,run_time. Is there a way to get these details?

[somesoni2 · Accepted solution]

You can try following query.

index=_audit action=search info=completed

This will give you fields like user, total run time,result count, time when search was executed, search time range and variety of other information.

Cheers.

[gfuente]

Hello

In the default search app, you have a few reports with search user activity, you can found them in:

Status\Search Activity\

In particular: Search Activity per user.

In addition to those reports, you have even more in the SOS app that you can download from apps.splunk.com

Regards