List of users who searched data of an index

[svelagala]

How to get users(SAML authenticated) list who searched for data under particular index(_internal) in the last 24hrs.

[to4kawa]

| tstats count where index=_audit TERM("_internal") by PREFIX("user=")

[svelagala]

I have used the query you have provided but it is not giving any results.
| tstats count where index=_audit TERM("_internal") by PREFIX("user=")

Also tried like this, but no use.
| tstats count where index=_audit by user

[to4kawa]

PREFIX() can work on splunk ver 8.
user is extracted at search time. so, you are not able to use with tstats
If your splunk version is ver 7.X:

index=_audit TERM("_internal") | stats count by user

It's faster when PREFIX can be used.

[svelagala]

Yes, it is 7.X for us.
index=_audit TERM("_internal") | stats count by user - this works good, but I would like to know the list of users based on index names.
For Example:
I would like to know the users who searched for all the index names ending with "_archive" like _internal_archive. if I run the below it is also giving wherever "_archive" is used, instead of not only in index names.
index=_audit TERM("*_archive") | stats count by user

Can you help me on this @to4kawa

[to4kawa]

index=_audit TERM("_internal") 
| stats count values(search) as search by user
| mvexpand search
| rex field=search "index=(?\S+)"
| eval index=trim(index,"\"")
| stats values(user) by index

[svelagala]

index=_audit TERM("_internal")
| stats count values(search) as search by user
| mvexpand search
| rex field=search "index=(?\S+)"
| eval index=trim(index,"\"")
| stats values(user) by index

Above query almost worked but it is giving only results related to _internal index. Actually, I am looking for indexes ending with "_archive". Hence I tried in the below way.

index=_audit
| stats count values(search) as search by user
| mvexpand search
| rex field=search "index=(?\S+)"
| eval index=trim(index,"\"")
| stats values(user) by index
|search index=*_archive

let me know in case any optimization/better query can be provided @to4kawa

[to4kawa]

It is not profitable.

[svelagala]

Then what could be suitable query for my requirement @to4kawa