Before creating my own set of knowledge objects to get information on user activity, especially around searches, I decided to see what else was out there.  I stumbled across the Search Activity app which seemingly has pretty much everything I am looking for.  However, it isn't working in my Splunk Enterprise 8.2 environment.  Most dashboards don't populate data and it will not use the SA-ldapsearch add-on that is installed, configured, and working properly.  My guess is that the app is no longer supported (no updates since 2019).  Is anyone successfully using the app in Splunk 8.x? Any other recommendations for a similar app that may exist?  The only other thing I found was the User Monitoring for Splunk app, which  has some of the things I am looking for.  The data reported doesn't seem to be complete, which may just require some tweaking.  Curious what others may be using, if anything, to gain insight into Splunk user activity, especially as it pertains to user search behavior. ... View more

I am not sure if anyone else has encountered this, but in our distributed environment that was just upgraded from 8.0.3 to 8.2.2, we have noticed issues with the health report manager.  The new IOWait feature in the health report is extremely "chatty" even though all other aspects of the deployment are in great shape.  Even though we can successfully disable the IOWait feature in the console and via a local health.conf file, the feature is still being included in the health report.  I've opened up a case with Splunk support, but was just wondering if anyone else has encountered this behavior. ... View more