It is hard to tell the actual volume searched, but you can have the count of the events searched each time.
index=_audit source=*audit* action=search scan_count | table _time user scan_count event_count result_count
- scan_count is how many events were explored based on the scoping conditions (index, timerange, sourcetype etc..)
- event_count is how many matched the search terms. (field condition, keywords ....)
- result_count is how many lines were returned after the processing