Slightly modified from sos, here's the search. It run great in the search app. And does display data on my dashboard, but the data is not sorted when shown on the dashboard.
(host="sp3ctxqs01" OR splunk_server=local) action=search (id=* OR search_id=)
| eval search_id=if(isnull(search_id), id, search_id)
| replace '' with * in search_id
| search search_id!=rt_* search_id!=searchparsetmp*
| rex "search='(? .?)', autojoin"
| rex "savedsearch_name=\"(? . ?)\"]["
| eval search=case(isnotnull(search),search,isnull(search) AND savedsearch_name!="","Scheduled search name : ".savedsearch_name,isnull(search) AND savedsearch_name=="","SID : ".search_id)
| convert num(total_run_time)
| eval user = if(user="n/a", "nobody", user)
| stats min(_time) as _time last(user) as user max(total_run_time) as total_run_time last(search) as search by search_id | search search_id=* search!=typeahead* search!="|history*" search!=_internal search!=_audit|sort -total_run_time
... View more