https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48459#M11571 <P>By "search forwarder" do you mean distributed search head? If so, I've updated the answer with some details to get you started on modifying the dashboard search to query all indexers.</P> Sat, 11 Sep 2010 09:46:20 GMT hulahoop 2010-09-11T09:46:20Z https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48456#M11568 <P>This should be an easy one, how do I get a list of my top users accessing Splunk?</P> Sat, 11 Sep 2010 05:44:02 GMT https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48456#M11568 tedder 2010-09-11T05:44:02Z https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48457#M11569 <P>In the Search App there is a dashboard showing:</P> <UL> <LI>Today's Usage by User</LI> <LI>Yesterday's Usage by User</LI> <LI>Last 7 days Usage by User</LI> </UL> <P>The dashboard is located under Status &gt; Search activity &gt; User activity.</P> <P>Is this what you are looking for?</P> <P>To make this work on a distirbuted search head I believe you'll have to modify the actual search. The searches which drive these dashboard panels are located in $SPLUNK_HOME/etc/apps/search/default/data/ui/views/search_user_activity.xml. Examine the first search:</P> <PRE><CODE>`audit_searchlocal` | `audit_rexsearch` | search search_id!=scheduler_* | convert num(total_run_time) | eval user = if(user="n/a", null(), user) | stats min(_time) as _time first(user) as user max(total_run_time) as total_run_time first(search) as search by search_id | search search=search* search!=*_internal* search!=*_audit* | chart median(total_run_time) as "Median search time" perc95(total_run_time) as "95th Percentile search time" sum(total_run_time) as "Total search time" count as "Search count" by user </CODE></PRE> <P>This search references 2 macros defined in $SPLUNK_HOME/etc/apps/search/default/macros.conf.</P> <PRE><CODE>[audit_searchlocal(1)] args = filter definition = search splunk_server=local index=_audit action=search (id=* OR search_id=*) | eval search_id = if(isnull(search_id), id, search_id) | replace '*' with * in search_id | search $filter$ [audit_rexsearch] definition = rex "search='(?&lt;search&gt;.*?)', autojoin" </CODE></PRE> <P>You can see in the audit_searchlocal macro, the local splunk server is the only one queried, probably why you are not seeing any results when running this on a distributed search head. Try removing "splunk_server=local" and see if you get any results.</P> Sat, 11 Sep 2010 07:11:06 GMT https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48457#M11569 hulahoop 2010-09-11T07:11:06Z https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48458#M11570 <P>those are what I needed, but they are empty. I had to go to a specific indexer rather than the search forwarder. Is there a way to get the rolled-up results?</P> Sat, 11 Sep 2010 09:01:52 GMT https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48458#M11570 tedder 2010-09-11T09:01:52Z https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48459#M11571 <P>By "search forwarder" do you mean distributed search head? If so, I've updated the answer with some details to get you started on modifying the dashboard search to query all indexers.</P> Sat, 11 Sep 2010 09:46:20 GMT https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48459#M11571 hulahoop 2010-09-11T09:46:20Z https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48460#M11572 <P>I have same problem, the result is empty <BR /> <CODE>audit_searchlocal</CODE> | timechart sum(total_run_time)</P> Tue, 29 Sep 2020 09:20:21 GMT https://community.splunk.com/t5/Splunk-Search/how-to-query-for-users-using-Splunk/m-p/48460#M11572 mplaksin 2020-09-29T09:20:21Z