How do I write a query for Audit Searches?

[NDabhi21]

Hi All,

Please suggest the query or solution to achieve below requirement.

1. List of searches or query run by user (looking for the report where shows searches as per user)

2. List of Searches/reports which use one particular index. (i.e - Use case: User locked out is using index=windows) 

[somesoni2]

You need to explore data in index=_audit for your requirements.

e.g. This can give you search (adhoc and scheduled) by user

index=_audit action=search search=* 
| stats dc(search_id) as searchCount by user

Getting data by index will not be 100% accurate as not every user uses "index=" as filter in every search (sometime they do google type search which is a bad practice OR sometime they use macros OR eventtypes).

[NDabhi21]

@somesoni2 : Thanks for the solution.

Its working for current environment .

Is there any option get index details which was used by above query output users