Can we get a query to fetch the savedsearches/dashboards which are running with timerange more than 24 hours

[Naga]

Can we get a query to fetch the savedsearches/dashboards which are running with timerange more than 24 hours

In oour search environment users are running the search in higher timeranges which is causing much load to our Infra. till it gets stabilized we wanted to allow users to run only searches within 24 hours not like Last 3 months / All time / Before This data kind of queries. So we wanted to filter such queries and inform the users. If its much critical we will allow them. Is there any way to pull like that?

[scelikok]

Hi @Naga,

You can use below search to get this information from _audit logs;

index=_audit action=search info=granted search='* 
| eval StartTime=strptime(apiStartTime,"'%a %b %d %H:%M:%S %Y'"), EndTime=strptime(apiEndTime,"'%a %b %d %H:%M:%S %Y'") 
| eval TimeRange=round(EndTime-StartTime,0) 
| where TimeRange>86400
| eval TimeRange=replace(toString(TimeRange,"duration"),"\+"," days ")
| rex "\ssearch\=\'(?<SPL>[^\$]+)\',\sautojoin"
| table _time user TimeRange apiStartTime apiEndTime SPL