How do I find out how many times an offensive search ran in the past day/week?

[ddrillic]

We have, what we believe to be an offensive search. How can we find out how many times it ran recently and by whom?

[somesoni2 · Accepted solution]

Is it a saved search or adhoc search?? If saved search, look at index=_internal sourcetypes=scheduler savedsearch_name=YourSearchName. For adhoc searches, check index=_audit.

[ddrillic]

Gorgeous !!!