you can use the _audit index to look at that.
index=_audit action=search search="<search string>"|stats count by user
as long as the field extractions work, shouldn't be a problem.
if for some reason the field extractions are broken, you might need to write a regex like this: |rex "user=(?<user>[^,]+)" to get user
