How to search the number of distinct users by index over the past 3 months?

[tcalhoon]

I am in need of a search that will display the number of Distinct users by index over the past 3 months. I have created the following search and run it over a 3month time span but I am wondering if this is the correct approach.

index=_audit NOT user="n/a" NOT user="splunk-system-user" action="search" info="granted" "search index=indexname" | timechart span=1mon count(_raw) by user

Please Advise
Thanks in Advance.

[David]

Unfortunately Splunk does not log this information today. Doing a search for index=* will only work if users specify an index each time. If you have a default set of indexes, that won't show up, and if they do something like index=prod-* to cover prod-windows, prod-linux, and prod-fw, you would not get accurate accounting. Ultimately, the big issue is the default indexes -- for most customers, all non-internal (and non-sensitive) indexes are searchable for the typical user role, so you wouldn't get any meaningful data.

[bmacias84]

I agree with @David. This would not account for saved searches or where users used a wildcard or specified no index.

[gschmitz]

I don't think this covers saved searches. They look completely different in my _audit index.