The best way to do is to go to your "Monitoring console"
splunk_url/en-US/app/splunk_monitoring_console/search_usage_statistics_instance
There is a "Only Ad Hoc Searches" radio choice. You can put to "No"
Once you do this, there will be a small "search icon" coming up under that panel. You can click on that search icon to get the search query/SPL behind it if you need it.
The core part of search is something like
(search_id!="rsa_*" action=search index=_audit sourcetype=audittrail)
| stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id
