topic Login dashboard thats too complex for me in Dashboards & Visualizations

Login dashboard thats too complex for me

williamsmew — Mon, 08 Jul 2019 21:52:42 GMT

I need to create a search string that shows the first interactive logon of the specified account and then the final logoff of the day for the same account. This is beyond me, ANY help is appreciated.

I am positive this is going to expand into a dashboard request showing all users in the office.

I probably have the wrong tags on it, no idea where this should go.

Re: Login dashboard thats too complex for me

richgalloway — Mon, 08 Jul 2019 22:43:46 GMT

What have you tried so far?

Re: Login dashboard thats too complex for me

woodcock — Tue, 09 Jul 2019 01:33:20 GMT

Show us your login and logout events.

Re: Login dashboard thats too complex for me

gcusello — Wed, 30 Sep 2020 01:12:01 GMT

Hi williamsmew,
are you speaking about Windows audit logs or application logs?
If Windows, there's a problem because Windows audit logs are very many and search is very slow (a Windows user login generates around 10-12 login/logout events and it's repeted many times in a connection!).

Anyway, the approach should be the following:

identify login and logout events (e.g. in windows login is Eventcode=4624 and logout is EventCode=2634),
then identify username field (e.g. in Windows is user),
ther run a search like the following (in Windows):

index=wineventlog (EventCode=4624 OR EventCode=4634)
| stats earliest(_time) AS earliest latest(_time) AS latest count BY user
In this way you have the first login and the last logout in a time period.

Bye.
Giuseppe