topic Re: active user session at any given time in Splunk Search

active user session at any given time

lain179 — Wed, 27 Mar 2013 17:40:36 GMT

Hi,

I would like to draw a chart representing number of active sessions at any given time...probably on a time chart.

The log contains three different type of log lines: Login, Log out and Expire sessions. I have come up with the following search so far, but it's not working well.


sourcetype="Engine" Server="ABC" login OR "log out" OR "removing session" | transaction UserSession | where duration=0 | timechart span=1m count(LoginDate) as in count(LogoutDate) as out count(LoginExpireDate) as expire | streamstats sum(in) as totalin sum(out) as totalout sum(expire) as totalexpire | eval totalactive=totalin-totalout-totalexpire

Thanks.

Re: active user session at any given time

takeda — Thu, 28 Mar 2013 02:17:04 GMT

Hi,

Why do you filter the result of transaction command with duration=0?
I think that causes Splunk to return sessions that immediately end after they start.

Maybe "concurrency" command can be used for your purpose.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Concurrency

Re: active user session at any given time

lain179 — Thu, 28 Mar 2013 17:35:15 GMT

Not true. If there is a duration, that mean the session has already started and ended and I don't need to count them because they are NOT active. Duration is measured in millisecond, so for any completed sessions, duration will be at least 1.

By filtering for duration = 0, I get three things:
- Login sessions that has not logout or expires yet
- logout session that has a login before the time range specified
- expired session that has a login before the time range specified

And no, concurrency is not what I need.