Find who all ran that query during a particular timeframe?

[Harishma]

I have a query, I want to know who all ran that query during a particular timeframe?
Is it possible to know?
Can someone kindly let me know(provide query) how to find this?

[cmerriman]

you can use the _audit index to look at that.

index=_audit action=search search="<search string>"|stats count by user

as long as the field extractions work, shouldn't be a problem.
if for some reason the field extractions are broken, you might need to write a regex like this: |rex "user=(?<user>[^,]+)" to get user