How to build a search to see user activity?

[mahesh27]

Hi All,
I wan to see user who are using splunk more.

I am using the below query:
|rest /services/authentication/users splunk_server=local

Here i am getting all results, but i need the list of users  who are using Splunk more.

[johnhuang]

This is a good approximate using UI access activity.

index=_internal sourcetype="splunkd_ui_access" earliest=-1d@d file=16* method=GET
| dedup file user
| dedup _time user
| stats count AS event_ct BY user

[richgalloway]

The query cited will list all registered Splunk users regardless of how much they use Splunk.

Please define "using Splunk more".  By what measure?

[mahesh27]

Like who is working for more time on splunk