How do we relate  index=_audit action=search search=* user!=splunk-system-user provenance!=scheduler | table _time user search host total_run_time result_count | sort - _time'  query to determine the SVC usage of the results  ... View more