https://community.splunk.com/t5/Splunk-Search/Report-on-how-log-a-user-was-logged-on/m-p/267176#M80379 <P>I am trying to generate a report that show how long users stayed logged on. I can do a search and find the users and event codes I am interested in but is there a way of comparing event times and generating a timeframe between events? In other words, is the a way to subtract the time that event code 4624 happened from event code 4634 for Account_Name=XXXX? </P> <P>Using Splunk 6.3 on Lynx getting events from Wineventlog_security.</P> Thu, 08 Oct 2015 14:46:22 GMT neiowe 2015-10-08T14:46:22Z https://community.splunk.com/t5/Splunk-Search/Report-on-how-log-a-user-was-logged-on/m-p/267176#M80379 <P>I am trying to generate a report that show how long users stayed logged on. I can do a search and find the users and event codes I am interested in but is there a way of comparing event times and generating a timeframe between events? In other words, is the a way to subtract the time that event code 4624 happened from event code 4634 for Account_Name=XXXX? </P> <P>Using Splunk 6.3 on Lynx getting events from Wineventlog_security.</P> Thu, 08 Oct 2015 14:46:22 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-how-log-a-user-was-logged-on/m-p/267176#M80379 neiowe 2015-10-08T14:46:22Z https://community.splunk.com/t5/Splunk-Search/Report-on-how-log-a-user-was-logged-on/m-p/267177#M80380 <P>Try something like this</P> <PRE><CODE>index=YourIndex source="WinEventLog:Security" EventCode=4624 OR EventCode=4634 | transaction Account_Name startswith=EventCode=4624 endswith=EventCode=4634 maxevents=2 | table _time Account_Name duration </CODE></PRE> Thu, 08 Oct 2015 19:49:50 GMT https://community.splunk.com/t5/Splunk-Search/Report-on-how-log-a-user-was-logged-on/m-p/267177#M80380 somesoni2 2015-10-08T19:49:50Z