topic Re: Splunk User Activity Report in Reporting

Splunk User Activity Report

itsmevic — Sat, 04 Jan 2020 06:08:06 GMT

I've been trying to put together a query that will show user activity within Splunk. I would also like to show what apps they have been in, and how long they were in the app as well as how many searches they performed. So far I've put this together:

index=_internal sourcetype= OR index=_audit sourcetype=* status="success" app=* user=*
|timechart span=1w count by user*

The only problem with this query is that it's not pulling the app names nor is it granular enough to pull the times spent in each app. Any help tightening this query syntax would be GREATLY appreciated.

Re: Splunk User Activity Report

mydog8it — Sat, 04 Jan 2020 21:39:25 GMT

In the future please use the "code sample" applet to insert SPL.
Without using the applet special characters and other formatting may not represented correctly.

Re: Splunk User Activity Report

mydog8it — Sat, 04 Jan 2020 21:44:00 GMT

This question is covered real well in this answer:
https://answers.splunk.com/answers/750048/see-user-activity-by-app-and-view.html