There are also some nice features in the S.o.S (Splunk on Splunk) App around user activity. It was released by Splunk and as such is also supported, it's available here http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk. Once installed you can then go to "Search >> UI and User Search Activity". It also has a load of other helpful features for troubleshooting.
... View more