Avg and most common Search time frame

[cboillot]

A quick search didn't find anything. I am looking to determine what the most used and avg Search window is. I.e. how far back are most of my users actually looking. Is this possible?

[richgalloway]

Perhaps this will get you started.

index=_audit sourcetype="searchactivity:searchhistory"
| stats mode(earliest) as modeTime, avg(earliest) as avgTime
| fieldformat avgTime=strftime(avgTime,"%c")

[cboillot]

hmm... The only sourcetype I have for the audit is audittrail.

[richgalloway]

Hmm...  Perhaps that sourcetype is unique to Splunk Cloud instances.  Here's another query to try.  It gives a list of relative times rather than a specific date, but that may be more helpful.

index=_audit "earliest=" | stats values(earliest)