Is there a way to Retrieve last 1000 searches performed on a particular index along with the user who performed search

[splunkfriend123]

Hi Team,

Is there any way to pull last 1000 searches performed on a particular index along with the user who performed that search

1. Splunk Query i am looking for 

2. Rest Query i am looking for 

I am running on Splunk 8.0 

[richgalloway]

It might be possible, but it will be a challenge.  Searching index=_audit action=search will return searches executed over time along with the user who ran them.  However, the search string may not include an index name.  Some searches use default indexes and in others the index name may be embedded in a macro or otherwise obfuscated.