topic Stat user duration connection in Splunk Search

Stat user duration connection

gloudou — Mon, 02 Jul 2012 21:44:50 GMT

Hello,

I would like to know if it's possible with Splunk to know the connection time of each user by day or month for example.

Thanks.

Re: Stat user duration connection

lguinn2 — Mon, 02 Jul 2012 22:29:29 GMT

You could try this:

yoursearchere |
transaction username ip startswith="Start connection." endswith="End connection" |
stats sum(duration) as TimeOnline by username |
fieldformat TimeOnline = tostring(TimeOnline,"duration")

However, if you have a large number of users who login in one day, the transaction command may not work well. But try this and see...

Re: Stat user duration connection

lguinn2 — Tue, 03 Jul 2012 16:13:10 GMT

yoursearchere | eval transactionEnd=0 | eval transactionEnd=case(match(_raw,".*end connection 1.*"),1, match(_raw,".*end connection 2.*"),1) transaction username ip startswith="Start connection." endswith=eval(transactionEnd==1) | stats sum(duration) as TimeOnline by username | fieldformat TimeOnline = tostring(TimeOnline,"duration")

That may help. The match function is case sensitive, so be exact!

Re: Stat user duration connection

lguinn2 — Tue, 03 Jul 2012 16:53:36 GMT

To count the number of connections per user:

Although a month may be too long of a timespan for the transaction command... If so, you might consider using a summary index to collect the daily info (number of Connections and TimeOnline)