topic Re: How to find the time duration between logins in Splunk Search

How to find the time duration between logins

dbcase — Tue, 28 Nov 2017 20:45:35 GMT

Hi,

I have a fun one.... fun being the operative word 🙂 I have data that looks like the below when someone logs in. I've extracted out the exr value which is unique when a customer logs in. What I'd like to do is track the time duration between 1 login for a customer and the next.

example. customer with exr of exr395164 logs in at 1:10 pm does some things then logs out, then logs in again at 2:15 pm. I'd like to calculate the 1:05 min and then get an average of all customer times between logins.

Any things?

{   [-] 
     Properties:    {   [-] 
         args:  [   [-] 
         {"accountId":"exr395164","customerId":"3555"}  
        ]   
         category:   Event  
         index:  1  
    }   
     analyticType:   CustomAnalytic 
     buildTarget:    blah   
     clientSessionId:    DXFMTCJ-BGKVKYL    
}

Re: How to find the time duration between logins

DalJeanis — Tue, 28 Nov 2017 20:53:22 GMT

Use streamstats.

your query that gets all the logins
| sort 0 _time 
| bin _time as day span=1d
| streamstats current=f last(_time) as lasttime by customer day
| eval duration= _time - lasttime

Now you have your duration between logins. How to calculate the average depends on what you mean.

This is the average time between logins, averaged on a login basis.

| stats avg(duration) as duration

This is the average time between logins, averaged on a customer basis.

| stats avg(duration) as duration by customer
| stats avg(duration) as duration

Re: How to find the time duration between logins

dbcase — Tue, 28 Nov 2017 21:09:19 GMT

Hi DalJeanis,

That is pretty slick..... Now I can glue back the clumps of hair 🙂 One quick (hopefully) question..... the duration is in seconds?

Re: How to find the time duration between logins

DalJeanis — Tue, 28 Nov 2017 22:46:11 GMT

@dbcase - yes, epoch time is in seconds, so subtracting two epoch times gives you an answer in seconds.

Re: How to find the time duration between logins

dbcase — Wed, 29 Nov 2017 14:42:44 GMT

Thank you!!