_internal sourcetype=searches isn't recording anything

[responsys_cm]

We've got Splunk 5.0.2 running on Windows. A few weeks ago (possibly when we upgraded, but I'm not sure), I stopped seeing events from sourcetype=searches.

Has that sourcetype been eliminated in this release? There are times where I want to go back to my historical searches to remember my work...

Thx.

C

[lguinn2]

One of these two searches will probably do the trick:

index=_internal source="*searches.log" | rex "\d{3} - (?<user>\S+)" | stats count by user

index=_audit user=* action=search search=* NOT "typeahead" NOT metadata NOT "|history" NOT "AUTOSUMMARY" 
| stats count by user

And yes, the information you want may have moved between releases.