topic Re: CurrentSessionLength TotalLoginLength in VMware Horizon Agent logs in Splunk Search

CurrentSessionLength TotalLoginLength in VMware Horizon Agent logs

user2020dy — Mon, 30 Nov 2020 11:43:27 GMT

Hello, guys,

I`m collecting logs from VMware Horizon client and here are 2 fields, the meaning of which I don`t clearly understand.

Is this length in seconds, minutes, hours?

And 2ond question: Maybe someone tried to calculate the session duration of Horizon logins and logons. Because here can be not only situations of simple logon and logoff , but also when the session was timed out and then the user reconnects. In ideal version I would like to check how many hours does the user spend using Horizon agent per day (to control working hours).

Re: CurrentSessionLength TotalLoginLength in VMware Horizon Agent logs

inventsekar — Mon, 30 Nov 2020 12:13:25 GMT

Hi @user2020dy may we know the SPL query please.

>>> Maybe someone tried to calculate the session duration of Horizon logins and logons.

the original logs does not have these? is it a new project you have joined? can you please share with us some sample logs..
how many team members are there? maybe you can directly ask them, or better, check the calculated fields/alias/tags/macros of all users.

there is a document "inherited deployments" that is good for understanding a new Splunk environment.

Re: CurrentSessionLength TotalLoginLength in VMware Horizon Agent logs

to4kawa — Mon, 30 Nov 2020 12:37:14 GMT

https://community.splunk.com/t5/Splunk-Enterprise-Security/How-can-I-monitor-VMware-Horizon-View-with-Splunk/m-p/474217