Is there a way to search for what searches have been run over a period of time and by who?

[Skins]

Hi,

Is there a way to search for what searches have been run over a period of time and by who - preferably listing the search run also?

gratzi

[mstjohn_splunk]

hi @skins

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[splunker12er]

Try this,

index=_audit action=search info=granted search=* NOT(user=splunk-system-user)  NOT "search_id='scheduler" NOT "search='|history" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" | stats values(search_id) values(search) by user  _time | sort _time | convert ctime(_time)