topic Re: Finding a Sessions Length in Splunk Search

Finding a Sessions Length

celdridge1988 — Wed, 29 Apr 2020 15:46:59 GMT

Hi All,
**
Summary
**
I have windows logs for remote VPN access. I want to be able to graph concurrent use by user. But the problem is : example - I have one log EventCode=123 which is a remote connection that occurs at 2pm for instance and EventCode=321 which is a disconnection that occurred at 5pm. Between the fields there are no logs so timecharting comes back with a 1 on 2pm and a 1 on 5pm but 0 on the hours between...I want to have a count on the hours between to show that the session was active. Is there a way to do this?

Re: Finding a Sessions Length

jg91 — Wed, 29 Apr 2020 16:10:32 GMT

Hello, I think you should use transaction command with username and startswith and endswith options.
... | transaction user startswith="EventCode=123" endswith="EventCode=321"
After that, you can use duration field in the result of transaction command to calculate session duration.

Re: Finding a Sessions Length

to4kawa — Wed, 29 Apr 2020 19:21:56 GMT

https://answers.splunk.com/answers/811217/concurrent-active-vpn-sessions-on-a-timechart.html

This is a similar question.

I made the query. It's not easy. good luck.

but now, here is the app.

https://www.splunk.com/en_us/blog/leadership/introducing-splunk-remote-work-insights-our-solution-for-the-new-work-from-home-reality.html