Splunk User Activity

[hartfoml]

I am trying to setup a dashboard to show how much time each user spent using Splunk each week.

Anyone got any suggestions how I can track user activity time in splunk _Internal or _Audit indexes.

[bravon]

I use "Splunk Health Check Overview" https://splunkbase.splunk.com/app/1919/ for this.

[chimell]

Hi hartfoml
try this search code

   index=_internal OR index=_audit status="success" |timechart span=1w count by user

[ChrisG]

You might want to use the Splunk on Splunk app (a good thing generally). See also the previous Answers posting, "Is it possible to monitor Splunk user activity".