https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17247#M2410 <P>goddamn i give up</P> Tue, 20 Jul 2010 02:20:35 GMT riderofyamaha 2010-07-20T02:20:35Z https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17241#M2404 <P>I want my table to show a column with what time a username connected to the network and another column showing when they disconnected the network...what is the field called and the shortcut to extract this info from my data?</P> <P>thanks, blake</P> Tue, 13 Jul 2010 01:44:38 GMT https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17241#M2404 riderofyamaha 2010-07-13T01:44:38Z https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17242#M2405 <P>Can you provide the sourcetype of the data you are trying to search? Otherwise, there is no way to know the name of the field. Thanks!</P> Tue, 13 Jul 2010 23:06:06 GMT https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17242#M2405 lguinn2 2010-07-13T23:06:06Z https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17243#M2406 <P>the sourcetype is syslog....as far as i can tell...is that what you mean? im new to the IT world, thanks for your patience and help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 14 Jul 2010 01:23:51 GMT https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17243#M2406 riderofyamaha 2010-07-14T01:23:51Z https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17244#M2407 <P>"syslog" is still too generic... with access to the network, which kind of device do you exactly mean? if you can provide us some data example we can help you extract the proper fields</P> Wed, 14 Jul 2010 02:53:04 GMT https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17244#M2407 Paolo_Prigione 2010-07-14T02:53:04Z https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17245#M2408 <P>i dont know what you mean by device. Do u mean server brand? but a data example is:</P> <P>Jul 12 12:48:54 foobar.net Jul 12 2010 12:25:03: %ASA-4-113019: Group = foobar, Username = Username1, IP = 10.238.96.133, Session disconnected. Session Type: IPsecOverNatT, Duration: 0h:27m:44s, Bytes xmt: 1879054, Bytes rcv: 591784, Reason: User Requested</P> <P>specifics removed for security...</P> <P>could someone please show me how to display a field for when a user connecting and disconnecting the network?</P> Thu, 15 Jul 2010 02:03:16 GMT https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17245#M2408 riderofyamaha 2010-07-15T02:03:16Z https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17246#M2409 <P>??????? come one guys</P> Fri, 16 Jul 2010 20:19:36 GMT https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17246#M2409 riderofyamaha 2010-07-16T20:19:36Z https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17247#M2410 <P>goddamn i give up</P> Tue, 20 Jul 2010 02:20:35 GMT https://community.splunk.com/t5/Splunk-Search/quick-fields-question-Time-connected-time-disconnect/m-p/17247#M2410 riderofyamaha 2010-07-20T02:20:35Z