Security

Splunk User Activity

hartfoml
Motivator

I am trying to setup a dashboard to show how much time each user spent using Splunk each week.

Anyone got any suggestions how I can track user activity time in splunk _Internal or _Audit indexes.

Tags (2)

bravon
Communicator

I use "Splunk Health Check Overview" https://splunkbase.splunk.com/app/1919/ for this.

0 Karma

chimell
Motivator

Hi hartfoml
try this search code

   index=_internal OR index=_audit status="success" |timechart span=1w count by user

ChrisG
Splunk Employee
Splunk Employee

You might want to use the Splunk on Splunk app (a good thing generally). See also the previous Answers posting, "Is it possible to monitor Splunk user activity".

0 Karma