topic Logon session time in Splunk Search

Logon session time

ghnwmlguy — Tue, 01 Feb 2011 07:31:04 GMT

I am trying to gather average login session times for a server given multiple users logon and logoff log entries. I am using ossec to filter the logs first so standard windows fields may not apply, but I have extracted the user field (called "user").

I am not really sure where to start since I cannot seem to figure out how to gather average user session times for any time period given there are multiple users.

Any ideas?

Re: Logon session time

David — Tue, 01 Feb 2011 07:53:02 GMT

If you have the events that indicate logon and logoff, you could build a transaction and then grab the duration, a la:

YourSearch | transaction Username startswith=LogonEventID endswith=LogoffEventID 
           | eval DurationInMin = round(duration/60,2) 
           | stats avg(DurationInMin) as "Average Session Duration (Minutes)" by Username

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

Re: Logon session time

ghnwmlguy — Tue, 01 Feb 2011 09:07:10 GMT

Thanks David, I can't beleive that have never noticed the transaction command.

Re: Logon session time

gkanapathy — Tue, 01 Feb 2011 10:39:24 GMT

Minor thing I'd do is only round after taking the average: `... | stats avg(DurationInMin) as avgdur by Username | eval avgdur=round(avgdur/60,2) | rename avgdur as "Average Session Duration (Minutes)".

Re: Logon session time

gkanapathy — Tue, 01 Feb 2011 10:41:50 GMT

Also, if there is a session ID (often there is not), it is probably more efficient (and definitely more scalable) to do: YourSearch | stats range(_time) as sessiondur by sessionID,Username | stats sum(sessiondur) as user_total_dur by Username instead.