Splunk Search to identify users searching back 30 days or more

[scout29]

I am trying to create a search that shows me all users that are searching back 30 days or longer in Splunk.

For example, if user123 ran a search of "index = windows" and selected a time picker value of 30 days, i would want the search results to show me the username, the search used, and the time picker used. 

I would want to see this for any users searching back 30 days or more in splunk.

This is what i have started with to use as a base search, but i am not finding any fields that show a time picker value:

index=_audit  action="search" 

[scout29]

I am trying to get a list of splunk users and searches that are searching back 30 DAYS or longer. 

[livehybrid]

Sorry, I was giving an example as I didnt have any users searching over 30 days.

Please see below, I have added a table command too.

index=_audit action="search" info=completed
| eval et=COALESCE(search_et, api_et), lt=COALESCE(search_lt, api_lt)
| eval timespanSecs=lt-et
| where timespanSecs>(60*60*24*30)
| eval friendlyTime=tostring(timespanSecs, "duration")
| table user search friendlyTime

Is this what you are after?

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[livehybrid]

Hi @scout29 

Try the following query, this takes the earliest time from the latest time to give the number of seconds searches across, then filter where >1800 (30 mins)

index=_audit action="search" info=completed
| eval et=COALESCE(search_et, api_et), lt=COALESCE(search_lt, api_lt)
| eval timespanSecs=lt-et
| where timespanSecs>1800

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

[scout29]

This is not what i am looking for -  i am trying to get a list of splunk users and searches that are searching back 30 DAYS or longer.