Oh my god finally, someone found it.  Here is a revised query that works a little better and shows the "files" (searches) enabled by a particular user and decodes them to make them easier to read.     index="_internal" sourcetype=splunkd_ui_access method=POST | eval file=urldecode(file) | stats values(file) by user ... View more