This one seems better as it exclude scheduled searches. index="_audit" [search index=_internal source="*web_access.log" user!="-" | stats by user | fields user] | search action="search" OR action="rtsearch" | stats values(action) as Action, values(info) as Info, max(timestamp) as lastTime, min(timestamp) as firstTime by user ... View more

Interesting! I didn't get that error but I tested on 5.0.2. Thanks for posting what worked for you! ... View more

sendemail did not work for me for some reason and I'm using Splunk v4.3.3 What did work was adding the following to the end of the search string: | outputcsv myfile.csv The output file was routed by default to the $SPLUNK_HOME/var/run/splunk folder. Thanks to @yannK for this answer to a different question: http://splunk-base.splunk.com/answers/42067/can-search-results-be-exported-using-a-command-in-the-search-scriptbar/42072 ... View more