topic Re: Finding the 1st logon and logoff event times for a single user from March 2017 to present. in Getting Data In

Finding the 1st logon and logoff event times for a single user from March 2017 to present.

JPurdham — Tue, 29 Aug 2017 09:04:11 GMT

Hello,

I've been asked to find the 1st login time of a user and the time they logged out over a specific date range. (march 1st 2017 - present)

The environment is a Window's terminal services environment (Windows Server 2008 R2) and is being indexed into Splunk. The index is index= index="wineventlog"

I'd like to see something like this; (if possible)

username: user
date: 01/MAR/2017
Logon: 07:30:00
Logoff: 15:30:00

For each day from march 1st to present, I can find the events but can't order them or filter them to show just the 1st login and last logoff of that day.

Appreciate the help,
Jake

Re: Finding the 1st logon and logoff event times for a single user from March 2017 to present.

gcusello — Tue, 29 Aug 2017 10:49:49 GMT

Hi JPurdham,
it's not a problem to have the first logon (EventCode=4624) but the problem is that in Windows a logon action generates many (more than 10) logon events (4624, 4672, 4634, ...) and it's difficoult to find the real logoff because there isn't a transaction code to connect events.
You could use username, but if you have more logons of the same user on the same host in the same day you cannot distinguish them.
Anyway, you could run something like this in the time period you need:

index=wineventlog sourcetype=WinEventLog:Security (EventCode=4624 OR EventCode=4634)
| eval day=strftime(_time,"%d/%m/%Y")
| stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")

Bye.
Giuseppe

Re: Finding the 1st logon and logoff event times for a single user from March 2017 to present.

nick405060 — Fri, 18 Jan 2019 00:18:45 GMT

Is this still true? I've been asked to do pretty much the exact same thing. Not logon and logoff times each day, but time spent on a specific server/resource

Re: Finding the 1st logon and logoff event times for a single user from March 2017 to present.

benbabich — Thu, 16 Jan 2020 21:14:35 GMT

This worked great for me.
After I Americanized the date format.

Re: Finding the 1st logon and logoff event times for a single user from March 2017 to present.

gcusello — Fri, 17 Jan 2020 07:38:45 GMT

Hi JPurdham,
if this answer solves your problem, please accept and/or upvote it for the other people of the Community.
Ciao and next time.
Giuseppe