https://community.splunk.com/t5/Getting-Data-In/Splunk-usage-monitor/m-p/49607#M9414 <P>Splunk provides a few built-in dashboards for that. Take a look in the Search-App under Status -&gt; Search Activity.</P> <P>Another option is to build some searches/reports based on the events in the _audit and/or _internal index. Like this one:</P> <PRE><CODE>index=_audit NOT user="n/a" NOT user="splunk-system-user" earliest=-30d action="login attempt" info="succeeded" | bucket span=1d _time | dedup user,_time | stats count by user | sort -count </CODE></PRE> <P>which displays on how many days the users have logged into Splunk in the last 30 days.</P> Tue, 14 Sep 2010 18:31:24 GMT ziegfried 2010-09-14T18:31:24Z https://community.splunk.com/t5/Getting-Data-In/Splunk-usage-monitor/m-p/49606#M9413 <P>How do I monitor how often my users are using Splunk?</P> Tue, 14 Sep 2010 16:56:47 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-usage-monitor/m-p/49606#M9413 devilears 2010-09-14T16:56:47Z https://community.splunk.com/t5/Getting-Data-In/Splunk-usage-monitor/m-p/49607#M9414 <P>Splunk provides a few built-in dashboards for that. Take a look in the Search-App under Status -&gt; Search Activity.</P> <P>Another option is to build some searches/reports based on the events in the _audit and/or _internal index. Like this one:</P> <PRE><CODE>index=_audit NOT user="n/a" NOT user="splunk-system-user" earliest=-30d action="login attempt" info="succeeded" | bucket span=1d _time | dedup user,_time | stats count by user | sort -count </CODE></PRE> <P>which displays on how many days the users have logged into Splunk in the last 30 days.</P> Tue, 14 Sep 2010 18:31:24 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-usage-monitor/m-p/49607#M9414 ziegfried 2010-09-14T18:31:24Z