Reporting

Splunk User Activity Report

itsmevic
Communicator

I've been trying to put together a query that will show user activity within Splunk. I would also like to show what apps they have been in, and how long they were in the app as well as how many searches they performed. So far I've put this together:

index=_internal sourcetype= OR index=_audit sourcetype=* status="success" app=* user=*
|timechart span=1w count by user*

The only problem with this query is that it's not pulling the app names nor is it granular enough to pull the times spent in each app. Any help tightening this query syntax would be GREATLY appreciated.

Tags (1)
0 Karma

mydog8it
Builder
0 Karma

mydog8it
Builder

In the future please use the "code sample" applet to insert SPL.
Without using the applet special characters and other formatting may not represented correctly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...