$field1.earliest$ $field1.latest$
-7d now
| stats sum(search_count) | stats dc(savedsearch_name) | stats sum(search_count) by savedsearch_name | sort -sum(search_count) | head 1 | table savedsearch_name | stats sum(search_count) AS sum_search_count by usage| search usage=adhoc | table sum_search_count | stats sum(search_count) AS sum_search_count by usage| search usage=scheduled | table sum_search_count | stats sum(search_count) AS search_count by user | sort -search_count | head 1 | table user | stats dc(user) | stats sum(search_total_run_time) | stats avg(search_total_run_time) |sort -search_total_run_time | head 1| table search_total_run_time | table savedsearch_name search_count last_run first_run search_avg_run_time search_total_run_time search_total_results