I've been trying to put together a query that will show user activity within Splunk. I would also like to show what apps they have been in, and how long they were in the app as well as how many searches they performed. So far I've put this together:
index=_internal sourcetype= OR index=_audit sourcetype=* status="success" app=* user=*
|timechart span=1w count by user*
The only problem with this query is that it's not pulling the app names nor is it granular enough to pull the times spent in each app. Any help tightening this query syntax would be GREATLY appreciated.
