https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276226#M83323 <P>Thanks, but ... it won't work. <BR /> Let's take the following scenario: Session ID 6 is Active from 01:00:00 to 01:01:00 (1 minute)<BR /> It goes in Disconnect from 01:01:00 to 01:03:00 (2 minutes)<BR /> It goes back to active from 01:03:00 to 01:10:00 (7 minutes).<BR /> What I need is to identify the State change and somehow to measure earliest and latest time for the events until state change, and then go on.... with the rest.<BR /> P.S. I already got to a similar result using streamstats, but I tried nevertheless your proposed answer, with no result ...</P> Thu, 10 Dec 2015 14:39:02 GMT sergiupopescu 2015-12-10T14:39:02Z https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276224#M83321 <P>So I am looking for help, I guess I just found something I can't do with Splunk... and I know I'm wrong, only I can't prove it!<BR /> It may be related to me (as I am somehow new to Splunk), so please help. Here goes:</P> <P>Basically, I have events like:</P> <PRE><CODE>Time | SessionId | State 01:00:00 | 7 | Active 01:01:00 | 7 | Disconnected 01:02:00 | 7 | Disconnected 01:03:00 | 7 | Active </CODE></PRE> <P>What I would like is to generate a report to show actual session durations (with start time and end time), something like this:</P> <PRE><CODE>Session 7 | State=Active | Start 01:00:00 | End 01:01:00 Session 7 | State=Disconnected | Start 01:01:00 | End 01:03:00 Session 7 | State=Active | Start 01:03:00 | End .... </CODE></PRE> <P>I tried with streamstats, but no go, and unfortunately I am in a lack of ideas, so any help would be highly appreciated!</P> Thu, 10 Dec 2015 12:19:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276224#M83321 sergiupopescu 2015-12-10T12:19:29Z https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276225#M83322 <P>Try something like this (this is untested, so you will have to tweak it to get it to work)</P> <PRE><CODE>your_search | reverse | eval ct=if(match(_raw, "Active"), 1, 0) | streamstats window=1 count(ct) as uid min(_time) as start max(_time) as end by SessionId | table _time SessionId start end State </CODE></PRE> Thu, 10 Dec 2015 14:19:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276225#M83322 sundareshr 2015-12-10T14:19:44Z https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276226#M83323 <P>Thanks, but ... it won't work. <BR /> Let's take the following scenario: Session ID 6 is Active from 01:00:00 to 01:01:00 (1 minute)<BR /> It goes in Disconnect from 01:01:00 to 01:03:00 (2 minutes)<BR /> It goes back to active from 01:03:00 to 01:10:00 (7 minutes).<BR /> What I need is to identify the State change and somehow to measure earliest and latest time for the events until state change, and then go on.... with the rest.<BR /> P.S. I already got to a similar result using streamstats, but I tried nevertheless your proposed answer, with no result ...</P> Thu, 10 Dec 2015 14:39:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276226#M83323 sergiupopescu 2015-12-10T14:39:02Z https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276227#M83324 <P>I didn't think about the start/end for disconnected state. This should do it. </P> <PRE><CODE>| sort sid | streamstats window=2 earliest(time) as start latest(time) as end by sid | table time sid state start end | eval end=if(end=start, strftime(now(), "%m/%d/%Y %H:%M"), end) </CODE></PRE> Thu, 10 Dec 2015 20:12:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-state-changes-for-RDP-sessions-and-generate-a/m-p/276227#M83324 sundareshr 2015-12-10T20:12:37Z