splunk-security_content/package/default/data/ui/views/escu_usage.xml

<form>
  <label>Usage Details</label>
  <search id="escu_usage" ref="escu-metrics-search-events">
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="field1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-7d</earliest>
        <latest>now</latest>
      </default>
      </input>
      </fieldset>
  <row>
    <panel>
      <single>
        <search base="escu_usage">
          <query>| stats sum(search_count)</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x091448","0xd93f3c"]</option>
        <option name="rangeValues">[1000]</option>
        <option name="underLabel">Searches Ran</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <search base="escu_usage">
          <query>| stats dc(savedsearch_name)</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x091448","0xd93f3c"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Unique Searches</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <search base="escu_usage">
          <query>| stats sum(search_count) by savedsearch_name | sort -sum(search_count) | head 1 | table savedsearch_name</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0x091448","0x091448"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Most Run</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search base="escu_usage">
          <query> | stats sum(search_count) AS sum_search_count by usage| search usage=adhoc | table sum_search_count</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x066661","0x091448"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Ad hoc searches</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <search base="escu_usage">
          <query> | stats sum(search_count) AS sum_search_count by usage| search usage=scheduled | table sum_search_count</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x066661","0x066661"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Scheduled</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <search base="escu_usage">
          <query>| stats sum(search_count) AS search_count by user | sort -search_count | head 1 | table user</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x066661","0x066661"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Most Active User</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <search base="escu_usage">
          <query>| stats dc(user)</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x066661","0x066661"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Total Active Users</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search base="escu_usage">
          <query>| stats sum(search_total_run_time)</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x334907","0x334907"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Total Search Run Time (seconds)</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <search base="escu_usage">
          <query> | stats avg(search_total_run_time)</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x334907","0x334907"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Average Run Time (seconds)</option>
        <option name="useColors">1</option>
      </single>
    </panel>
    <panel>
      <single>
        <search base="escu_usage">
          <query>|sort -search_total_run_time | head 1| table search_total_run_time</query>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x334907","0x334907"]</option>
        <option name="rangeValues">[12000]</option>
        <option name="underLabel">Max Run Time (seconds)</option>
        <option name="useColors">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search base="escu_usage">
          <query>| table savedsearch_name search_count last_run first_run search_avg_run_time  search_total_run_time search_total_results </query>
        </search>
      </table>
    </panel>
  </row>
</form>