Hello, I'm trying to search Splunk for user activity pertaining to logging into Splunk for X # of days. Everything I've tried so far returns some results but not all.  I've searched the _audit index as well as |rest /services/authentication/httpauth-tokens | fields userName, timeAccessed |dedup userName sortby timeAccessed.  Does anyone have a search for this or a dashboard that would pull this information? I need: user, date last accessed at a minimum.   Thanks, Craig           ... View more

I'm looking to do some alerting or analysis to help troubleshoot lag time and logging. I'd like to compare the _indextime and _time fields to see how long it's taking the actual events to get indexed by Splunk. We have some users for 1 specific index that are stating they are seeing at least a couple of hours lag time between the event being generated and when Splunk is indexing the event. This is for initial research for the issue to help determine network issue, Splunk issue or other. Thanks for any help! ... View more