VPN count

dmenon — Wed, 30 Sep 2020 04:51:16 GMT

Hi - We want to get users connected in 1 hour. When a user connects we get event_id="globalprotectgateway-auth-succ" in logs and when they disconnect then event_id is event_id="globalprotectgateway-logout-succ" . Each login in and logout should be counted as 1 event per hour but sometimes user just remains logged in and there is no logout even in that case we want the user to be counted as logged in user since they haven't logged out.

(index=firewall OR index=cloud_firewall) eventtype="pan_system" log_subtype="globalprotect" sourcetype="pan:system" ( event_id="globalprotectgateway-auth-succ" OR event_id="globalprotectgateway-logout-succ" OR "globalprotectportal-gencookie-succ") | eval logins = strftime(_time,"%H") | transaction user startswith="globalprotectgateway-auth-succ" endswith= "globalprotectgateway-logout-succ" | stats values(user), distinct_count(user) by logins

This works fine with login and logout for every 60 mins but if there is a user session that has not logged out then that user doesnt get counted in hourly user count.

Re: VPN count

woodcock — Wed, 01 Apr 2020 20:00:50 GMT

You need the concurrency command. See here for an example similar to your use-case which you should be able to adapt:
https://answers.splunk.com/answers/319585/how-to-graph-the-number-of-active-sessions-over-ti.html

topic VPN count in Splunk Search

VPN count

Re: VPN count

Re: VPN count