topic Re: How to create Screen Lock Time of Windows PC calculation into timechart in Splunk Search

How to create sleep time of Windows PC calculation into timechart?

skovachev — Wed, 16 Feb 2022 04:46:11 GMT

Hi, I am using following search into Windows EventViewer System logs that I extracted for testing:

index="503461" host="hp-laptop" "Sleep Time"

Log looks like below:

Information,4.2.2022 г. 12:55:47,Microsoft-Windows-Power-Troubleshooter,1,None,"The system has returned from a low power state.

Sleep Time: ‎2022‎-‎02‎-‎04T10:38:18.391571900Z
Wake Time: ‎2022‎-‎02‎-‎04T10:55:46.701556600Z

Wake Source: Device -USB Composite Device"

I am trying to calculate the two time stamps into total duration. Can someone help with the search string, thank you 🙂

Re: How to create Sleep Time of Windows PC calculation into timechart

VatsalJagani — Fri, 11 Feb 2022 08:26:43 GMT

Easy:

index="503461" host="hp-laptop" "Sleep Time" | rex field=Sleep_Time max_match=0 "(?<test>[\w:\.\-]+)" | eval Sleep_Time = mvjoin(test, "") | rex field=Wake_Time max_match=0 "(?<test2>[\w:\.\-]+)" | eval Wake_Time = mvjoin(test2, "") | eval Sleep_Time2=strptime(Sleep_Time, "%FT%T.%9QZ") | eval Wake_Time2=strptime(Wake_Time, "%FT%T.%9QZ") | eval Duration=Wake_Time2-Sleep_Time2

* line-2 and line-3 are to remove special characters from the _raw time as what I saw in case.

* line-3 and line-4 convert the string time format to an epoch number.

* line-5 calculate the duration in seconds (floating point number)

Re: How to create Screen Lock Time of Windows PC calculation into timechart

skovachev — Mon, 14 Feb 2022 12:27:50 GMT

HI Vatsa,

Thank you for the time you spent with my problem. I am unable to figure out the regex.

I am trying another scenario now where I calculate the Scree Locked time minus the screen Unlock time so I can get total duration of screen was locked on a windows pc. Here are the logs and what I managed to put together so far.

Information,Audit Success,11.2.2022 г. 13:51:11,Microsoft-Windows-Security-Auditing,4800,Other Logon/Logoff Events,Security,"The workstation was locked.

Information,Audit Success,11.2.2022 г. 13:51:19,Microsoft-Windows-Security-Auditing,4801,Other Logon/Logoff Events,Security,"The workstation was unlocked.

I would appreciate any help with substracting Locked time from Unlock time and creating a Mon-Fri timechart that shows duration of a pc on screenlock 🙂

Re: How to create Screen Lock Time of Windows PC calculation into timechart

VatsalJagani — Mon, 14 Feb 2022 14:18:41 GMT

This is totally different scenario because in the original case you had both the information in a single event but here you have two events for two activities.

Try something like this:

index="........." | eval message=if((eventid=4800),"LOCKED", "UNLOCKED") | transaction maxevents=2 host startswith="message=LOCKED" endswith="message=UNLOCKED"

See you should have a duration field in the results now. If you are getting all negative values, interchange startswith with endswith in the transaction command. Or you can also take abs(duration) with eval, which will also convert negative values to positive values. Or you can also multiply by -1.

Once you have it you can do timechart or stats whatever you want to apply after that.

Re: How to create Screen Lock Time of Windows PC calculation into timechart

VatsalJagani — Wed, 16 Feb 2022 04:31:07 GMT

Please accept the solution if the answer was helpful to you.