I have a query, I want to know who all ran that query during a particular timeframe?
Is it possible to know?
Can someone kindly let me know(provide query) how to find this?
you can use the _audit index to look at that.
index=_audit action=search search="<search string>"|stats count by user
as long as the field extractions work, shouldn't be a problem.
if for some reason the field extractions are broken, you might need to write a regex like this: |rex "user=(?<user>[^,]+)" to get user