https://community.splunk.com/t5/Splunk-Search/How-to-get-active-VPN-Sessions-Cisco-ASA-Logs-with-Datamodel/m-p/349618#M103489 <P>Hello together,</P> <P>I probe to get the active session count from our asa logs per minute.<BR /> I created a datamodel (CASA) which contains the username and also the <CODE>session_duration</CODE> field if the session is closed.<BR /> A session can only timeout after 15 minutes, if no packet arrives by the vpn gateway.<BR /> Also, a session can be active over years, so the correlation from session start and logout events are not possible.</P> <P>Actually i had this:</P> <PRE><CODE>| tstats estdc(ASA.Username) as UsrC count(ASA.session_duration) as LogC from datamodel=CASA where (nodename = ASA.VPN) groupby _time, host prestats=false span=15m | eval "Active Sessions"=UsrC - LogC time | host | UsrC | LogC | Active Sessions 23:00 | vpnhost1 | 103 | 15 | 88 23:15 | vpnhost1 | 99 | 15 | 84 23:30 | vpnhost1 | 85 | 11 | 74 23:45 | vpnhost1 | 82 | 11 | 71 </CODE></PRE> <P>I think the solution would be that every minute he count and dedup the field ASA.Username for the last 15 minutes.<BR /> But actually, I have no idea to solve this.</P> <P>Did anyone have a solution to my problem or need additional information to help?</P> Tue, 30 Jan 2018 13:22:38 GMT ronpestler1 2018-01-30T13:22:38Z https://community.splunk.com/t5/Splunk-Search/How-to-get-active-VPN-Sessions-Cisco-ASA-Logs-with-Datamodel/m-p/349618#M103489 <P>Hello together,</P> <P>I probe to get the active session count from our asa logs per minute.<BR /> I created a datamodel (CASA) which contains the username and also the <CODE>session_duration</CODE> field if the session is closed.<BR /> A session can only timeout after 15 minutes, if no packet arrives by the vpn gateway.<BR /> Also, a session can be active over years, so the correlation from session start and logout events are not possible.</P> <P>Actually i had this:</P> <PRE><CODE>| tstats estdc(ASA.Username) as UsrC count(ASA.session_duration) as LogC from datamodel=CASA where (nodename = ASA.VPN) groupby _time, host prestats=false span=15m | eval "Active Sessions"=UsrC - LogC time | host | UsrC | LogC | Active Sessions 23:00 | vpnhost1 | 103 | 15 | 88 23:15 | vpnhost1 | 99 | 15 | 84 23:30 | vpnhost1 | 85 | 11 | 74 23:45 | vpnhost1 | 82 | 11 | 71 </CODE></PRE> <P>I think the solution would be that every minute he count and dedup the field ASA.Username for the last 15 minutes.<BR /> But actually, I have no idea to solve this.</P> <P>Did anyone have a solution to my problem or need additional information to help?</P> Tue, 30 Jan 2018 13:22:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-active-VPN-Sessions-Cisco-ASA-Logs-with-Datamodel/m-p/349618#M103489 ronpestler1 2018-01-30T13:22:38Z