Going through the audit logs I found this query helpful.   index=_audit action=create_saved_search actions=* app=* disabled=* info=* user=* | table _time savedsearch user action actions app disabled info ... View more