I am trying to setup a dashboard to show how much time each user spent using Splunk each week.
Anyone got any suggestions how I can track user activity time in splunk _Internal or _Audit indexes.
I use "Splunk Health Check Overview" https://splunkbase.splunk.com/app/1919/ for this.
try this search code
index=_internal OR index=_audit status="success" |timechart span=1w count by user
You might want to use the Splunk on Splunk app (a good thing generally). See also the previous Answers posting, "Is it possible to monitor Splunk user activity".