Getting Data In

Splunk usage monitor

devilears
New Member

How do I monitor how often my users are using Splunk?

Tags (1)
0 Karma

ziegfried
Influencer

Splunk provides a few built-in dashboards for that. Take a look in the Search-App under Status -> Search Activity.

Another option is to build some searches/reports based on the events in the _audit and/or _internal index. Like this one:

index=_audit NOT user="n/a" NOT user="splunk-system-user" earliest=-30d action="login attempt" info="succeeded" | bucket span=1d _time | dedup user,_time | stats count by user | sort -count

which displays on how many days the users have logged into Splunk in the last 30 days.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...