Use the Usage dashboards
The dashboards accessed from the Cloud Monitoring Console > Usage tab enable Splunk Cloud administrators to monitor the users who have access to your Splunk Cloud deployment. The User Activity dashboard lets you review user activity in the system over a specified time range. The User Detail dashboard lets you drill down into the activities of a specific user.
A blue progress bar might appear above a panel, indicating that the Splunk platform is still generating data. Wait for the bar to disappear before reviewing the panel.
Do not modify any Cloud Monitoring Console (CMC) dashboard. Changing any of the search criteria, formatting, or layouts may cause inaccurate results and also override the automatic update process.
View user activity
The CMC User Activity dashboard provides statistical information to Splunk Cloud administrators about all users with access to your Splunk Cloud deployment, including their pageviews and apps. Use this dashboard to understand your users' activity and take the appropriate action to monitor their behavior.
Review the User Activity dashboard
This dashboard shows summary and detailed information about user activity within a specified time range. The time range value affects all panels. The dashboard generally shows information for multiple users, but this is dependent on the number of users active during the specified time range.
The top three panels are summarized totals of a particular area: users, apps, or pageviews. You use the middle three panels to analyze more specific data about each area by setting a Sort by option. The bottom panel provides a tabular summary of the Total Pageviews panel.
The Pageviews area contains two panels with a variable in the panel title that you set with a filter option: Top <variable> and <variable> Access over Time.
To investigate your panels, go to Cloud Monitoring Console > Usage > User Activity. Use the following table to understand the dashboard interface.
|Panel or Filter||Description|
|Time Range||Set the time range for the data display.
This time range setting affects the display of all panels on this page.
|Distinct Users||Shows the total number of distinct users who were active in the specified time range.
To view the individual users included in this total and their access activity, sort by User in Pageviews.
|Distinct Apps||Shows the total number of distinct apps that were active in the specified time range.
To view the individual apps in this total and their access activity, sort by App in Pageviews.
|Total Pageviews||Shows the number of total pageviews that were accessed in the specified time range.
To view the individual pages in this total and their access activity, sort by Page in Pageviews.
|Pageviews||This area includes the Top <variable> and <variable> Access over Time panels. The <variable> changes depending on the selected Sort by option.
Select a Sort by option to view data by user, app, or page. The panels show the following pie chart and a bar chart combinations:
|Activity by Page||Shows the number of distinct users and pageviews for a specific app page.
Like the Top Pages and Page Access over Time panels, this panel provides additional information for the Total Pageviews panel.
Interpret user activity results
When interpreting your user activity results, note the following:
- When analyzing a particular area, be sure to select the corresponding Sort by option in Pageviews so that you view the summarized total and detail information together. For example, select Users when you are investigating distinct users to include the information at the Top Users and User Access over Time panels.
- If a particular user has a large number of pageviews, this might indicate that users are sharing credentials, or that the account is being used on a dashboard with multiple refreshes, creating additional search load.
View user detail
The CMC User Detail dashboard provides comprehensive information to Splunk Cloud administrators about the activities of a specific user in your Splunk Cloud deployment. Use this dashboard to investigate a user, particularly their searches and pageviews.
Review the User Detail dashboard
This dashboard contains 10 panels of summary, graphical, and tabular data about a specific user of your Splunk Cloud implementation. Filter the results by specifying a time range.
To investigate your panels, go to Cloud Monitoring Console > Usage > User Detail. Use the following table to understand the dashboard interface.
|Panel or Filter||Description|
|User and Time Range||Select a user and time range to populate the dashboard.
When you view this dashboard, the User field is automatically populated with the first menu value. Be sure to change this default value to the user you are investigating.
|Name||Shows the user's full name as defined in their user profile.|
|Username||Shows the user's system name, which may be formatted as an email account.|
|Roles||Shows the user's roles as assigned in Settings > Users and Authentication > Roles.|
|User Logins||Shows the number of times the user has logged into the deployment.|
|Search Count||Shows the number of searches the user has done.|
|Average Search Runtime||Shows the average runtime of all searches performed.|
|Total Search Time||Shows the total of the combined runtimes for all the user's searches.|
|Searches by Type||Provides a bar chart of the types of searches the user performed over time, such as ad hoc.|
|Pageviews by App||Provides a bar chart of pageviews, color-coded by app.|
|User Search Detail||Provides detailed information for each search done by the user, such as its type, start and run times, and host and search identifiers.|
Interpret user detail results
When interpreting your user detail results, note the following:
- Especially for new deployments, use this dashboard to monitor usage and determine if your users are adopting or rejecting the Splunk platform. A downward trend may indicate users need more training, or that there are other issues that require investigation and resolution.
- Check if the values in the second row of panels (Search Count, Average Search Runtime, and Total Search Time) increase significantly over time. Depending on the user's role and responsibilities, this may indicate behavior that needs further investigation.
- Analyze if the Searches by Type and Pageviews by App graphs reveal any patterns of behavior that could be optimized.
Use the Search dashboards
Use the License Usage dashboards
This documentation applies to the following versions of Splunk Cloud™: 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011, 8.1.2012 (latest FedRAMP release), 8.1.2101, 8.1.2103, 8.2.2104