topic Re: How can I track time that a user is using VPN access outside the country? in Splunk Search

How can I track time that a user is using VPN access outside the country?

digital_alchemy — Thu, 14 Jul 2016 15:19:08 GMT

I have a need to track VPN access outside the country. I have an alert that triggers when someone accesses the VPN from outside the country but I would like to make another search to track the amount of time they have been outside the country based on the event time stamp.

Current search to alert on OCONUS VPN use:

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | dedup vpn_user,Country | table _time,vpn_user,Country,vpn_remote_ip

I would like to modify the above search to create a report that would show something like below:

User              OCONUS time
User1             15 days
User2              9 days

Re: How can I track time that a user is using VPN access outside the country?

somesoni2 — Thu, 14 Jul 2016 15:33:06 GMT

Try this

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | eval Day=strftime(_time,"%m/%d/%Y") | stats dc(Day) as "OCONUS time" by  vpn_user

Re: How can I track time that a user is using VPN access outside the country?

sundareshr — Thu, 14 Jul 2016 17:45:09 GMT

Try this

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | stats earliest(_time) as logintime by  vpn_user | eval duration=now()-logintime |  eval Day=strftime(logintime,"%m/%d/%Y") | eval duration=tostring(duration, "duration") | rename logintime AS "OCONUS time" | table vpn_user "OCONUS time"

Re: How can I track time that a user is using VPN access outside the country?

woodcock — Fri, 15 Jul 2016 21:50:53 GMT

We need an example of both a VPN start event and a VPN stop event.