Hi a212830
Click on this link i think it will help well
http://answers.splunk.com/answers/210608/how-to-include-an-app-name-as-a-part-of-the-search.html
index= _audit action=search
| eval [rest /
services/ search /
jobs
splunk_server = loca
l | addinfo |
where sid =
info_sid | rename
eai: acl. app as
my_app_name |
return
my_app_name ]|stats count(search) AS "Number of search" by my_app_name
Do you mean saved searches? Or currently running searches? Or saved searches present in an app?
Could you please be more specific.