code: func (h *Handler) clusterSearchEvents(w http.ResponseWriter, r *http.Request, p httprouter.Params, ctx *SessionContext, site reversetunnel.RemoteSite) (interface{}, error) {
  	values := r.URL.Query()
  	from, err := queryTime(values, "from", time.Now().UTC().AddDate(0, -1, 0))
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	to, err := queryTime(values, "to", time.Now().UTC())
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	limit, err := queryLimit(values, "limit", defaults.EventsIterationLimit)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	query := url.Values{}
  	if include := values.Get("include"); include != "" {
  		query[events.EventType] = strings.Split(include, ";")
  	}
  	clt, err := ctx.GetUserClient(site)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	fields, err := clt.SearchEvents(from, to, query.Encode(), limit)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	return eventsListGetResponse{Events: fields}, nil
  }
docs: // clusterSearchEvents returns all audit log events matching the provided criteria
  //
  // GET /v1/webapi/sites/:site/events/search
  //
  // Query parameters:
  //   "from"   : date range from, encoded as RFC3339
  //   "to"     : date range to, encoded as RFC3339
  //   "include": optional semicolon-separated list of event names to return e.g.
  //              include=session.start;session.end, all are returned if empty
  //   "limit"  : optional maximum number of events to return
  //