Is there an app or search for dashboards and alerts to track activity of Splunk users with ADMIN roles?

[atx876]

We have quite a few users with Splunk "Admin" roles. Is there a way to create a dashboards/alerts when splunk users with ADMIN role logs in? In other words, is there an app or search to track Splunk users with ADMIN privileges? We are using local Splunk authentication.

[jimodonald]

I'm not aware of an app for that, but you should be able to roll your own.

Here is a search for all your admin users:

| rest /services/authentication/users | where roles="admin" | dedup title | table title, roles, realname

You should then be able to take that small list as a filter for index=_audit.