Before creating my own set of knowledge objects to get information on user activity, especially around searches, I decided to see what else was out there. I stumbled across the Search Activity app which seemingly has pretty much everything I am looking for. However, it isn't working in my Splunk Enterprise 8.2 environment. Most dashboards don't populate data and it will not use the SA-ldapsearch add-on that is installed, configured, and working properly. My guess is that the app is no longer supported (no updates since 2019). Is anyone successfully using the app in Splunk 8.x?
Any other recommendations for a similar app that may exist? The only other thing I found was the User Monitoring for Splunk app, which has some of the things I am looking for. The data reported doesn't seem to be complete, which may just require some tweaking. Curious what others may be using, if anything, to gain insight into Splunk user activity, especially as it pertains to user search behavior.
