Report on user engagement in Splunk

[spammenot66]

Is there a way to grasp user engagement within splunk. For example, in regards to all users under "user" role, I would like to try to report on the following:
1) how long they stay on a specific dashboard
2) login / log off time
3) are they experiencing any errors

help on any of the above would be greatly appreciated.

[anmolpatel]

This should help get started:
1) i've not seen a solution for that, you can look at last access time for a dashboard with this search
index=_internal sourcetype="splunkd_ui_access" "/data/ui/views/*"

2) you can use this answer:
https://answers.splunk.com/answers/225682/how-to-search-splunks-internal-audit-events-to-see.html

3) this will give you errors from the search(es) user has executed:
index=_internal sourcetype=splunkd ERROR

[woodcock]

There are other OS-level and/or browser add-ons that do this kind of thing. Splunk does not.