log to see what searches users have run

[gurinderbhatti]

as an admin, can i find out what searches my users have run? time, syntax, etc.
is there an audit log or something related to that.

[somesoni2]

Try this:

| rest /services/search/jobs |rename custom.search as customSearch|search NOT author="splunk-system-user" | eval SearchString=if(isnotnull(customSearch),customSearch,eventSearch)| addtotals fieldname=duration *duration_secs| table author,x, Y,SearchString , earliestTime,latestTime,request.earliest_time, request.latest_time, eventCount,duration

[dpapenbro]

This is good, it gives some of what i need. How do i get the saved 'Name' associated with the search results.

[martin_mueller]

Yes.

Take a look at the SoS app: http://apps.splunk.com/app/748/
In there go to the Search menu, and take a look around.

That's all based on pre-existing Splunk logs, so you can build your own searches off the app's suggestions.