https://community.splunk.com/t5/Splunk-Search/How-to-calculate-length-of-session/m-p/103638#M183077 <P>I have ssh events in the following log format:</P> <P>sshd[31922]: pam_unix(sshd:session): session closed for user root</P> <P>sshd[31922]: pam_unix(sshd:session): session opened for user root by (uid=0)</P> <P>sshd[30954]: pam_unix(sshd:session): session closed for user root</P> <P>sshd[30954]: pam_unix(sshd:session): session opened for user root by (uid=0)<BR /> ...</P> <P>How difficult would it be to generate a report each week that lists each session and its length?</P> <P>It seems like I need to do something similar to this thread (<A href="http://splunk-base.splunk.com/answers/4886/eval-time-between-events-for-transaction-by-group">http://splunk-base.splunk.com/answers/4886/eval-time-between-events-for-transaction-by-group</A>), but I'm not sure exactly how I would apply this to my situation - how do I ensure that the proper session open and close events are correlated?</P> Thu, 03 Nov 2011 22:00:35 GMT crobicha 2011-11-03T22:00:35Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-length-of-session/m-p/103638#M183077 <P>I have ssh events in the following log format:</P> <P>sshd[31922]: pam_unix(sshd:session): session closed for user root</P> <P>sshd[31922]: pam_unix(sshd:session): session opened for user root by (uid=0)</P> <P>sshd[30954]: pam_unix(sshd:session): session closed for user root</P> <P>sshd[30954]: pam_unix(sshd:session): session opened for user root by (uid=0)<BR /> ...</P> <P>How difficult would it be to generate a report each week that lists each session and its length?</P> <P>It seems like I need to do something similar to this thread (<A href="http://splunk-base.splunk.com/answers/4886/eval-time-between-events-for-transaction-by-group">http://splunk-base.splunk.com/answers/4886/eval-time-between-events-for-transaction-by-group</A>), but I'm not sure exactly how I would apply this to my situation - how do I ensure that the proper session open and close events are correlated?</P> Thu, 03 Nov 2011 22:00:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-length-of-session/m-p/103638#M183077 crobicha 2011-11-03T22:00:35Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-length-of-session/m-p/103639#M183078 <P>Looking at the question you linked to, that one covers how to calculate the time <EM>between</EM> sessions whereas in your case you need to calculate the time <EM>within</EM> the session. This should be pretty easy to achieve by creating a transaction based on the pid. Assuming you have the pid extracted into a field with the same name, just do</P> <PRE><CODE>... | transaction pid startswith="session opened" endswith="session closed" </CODE></PRE> <P>When the <CODE>transaction</CODE> command creates transactions, it always outputs a field for each transaction called "duration", which is exactly what it sounds like - the duration of the transaction, in seconds. So to get a table of all sessions and their lengths, do something like this (assuming you have the user extracted into a field called "user"):</P> <PRE><CODE>... | transaction pid startswith="session opened" endswith="session closed" | table _time user duration </CODE></PRE> Thu, 03 Nov 2011 22:22:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-length-of-session/m-p/103639#M183078 Ayn 2011-11-03T22:22:18Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-length-of-session/m-p/103640#M183079 <P>Thanks Ayn, that's exactly what I needed!</P> Fri, 04 Nov 2011 14:18:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-length-of-session/m-p/103640#M183079 crobicha 2011-11-04T14:18:40Z