https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46417#M1517 <P>Hi hartfoml<BR /> try this search code</P> <PRE><CODE> index=_internal OR index=_audit status="success" |timechart span=1w count by user </CODE></PRE> Fri, 17 Apr 2015 06:52:49 GMT chimell 2015-04-17T06:52:49Z https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46415#M1515 <P>I am trying to setup a dashboard to show how much time each user spent using Splunk each week.</P> <P>Anyone got any suggestions how I can track user activity time in splunk _Internal or _Audit indexes.</P> Wed, 27 Feb 2013 21:15:04 GMT https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46415#M1515 hartfoml 2013-02-27T21:15:04Z https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46416#M1516 <P>You might want to use the <A href="http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk">Splunk on Splunk app</A> (a good thing generally). See also the previous Answers posting, <A href="http://splunk-base.splunk.com/answers/49089/is-it-possible-to-monitor-splunk-user-activity">"Is it possible to monitor Splunk user activity"</A>.</P> Wed, 27 Feb 2013 21:18:36 GMT https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46416#M1516 ChrisG 2013-02-27T21:18:36Z https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46417#M1517 <P>Hi hartfoml<BR /> try this search code</P> <PRE><CODE> index=_internal OR index=_audit status="success" |timechart span=1w count by user </CODE></PRE> Fri, 17 Apr 2015 06:52:49 GMT https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46417#M1517 chimell 2015-04-17T06:52:49Z https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46418#M1518 <P>I use "Splunk Health Check Overview" <A href="https://splunkbase.splunk.com/app/1919/">https://splunkbase.splunk.com/app/1919/</A> for this.</P> Sat, 18 Apr 2015 20:26:36 GMT https://community.splunk.com/t5/Security/Splunk-User-Activity/m-p/46418#M1518 bravon 2015-04-18T20:26:36Z