A quick search didn't find anything. I am looking to determine what the most used and avg Search window is. I.e. how far back are most of my users actually looking. Is this possible?
Perhaps this will get you started.
index=_audit sourcetype="searchactivity:searchhistory"
| stats mode(earliest) as modeTime, avg(earliest) as avgTime
| fieldformat avgTime=strftime(avgTime,"%c")
Hmm... Perhaps that sourcetype is unique to Splunk Cloud instances. Here's another query to try. It gives a list of relative times rather than a specific date, but that may be more helpful.
index=_audit "earliest=" | stats values(earliest)