I use "Splunk Health Check Overview" https://splunkbase.splunk.com/app/1919/ for this.
Hi hartfoml
try this search code
index=_internal OR index=_audit status="success" |timechart span=1w count by user
You might want to use the Splunk on Splunk app (a good thing generally). See also the previous Answers posting, "Is it possible to monitor Splunk user activity".