Logon/Logoff Tracking

[Paladium]

When performing user monitoring on behalf of HR or when requested by a supervisor (or performing forensics/investigations), we need a way to capture the first logon date/time and final logoff date/time each day. I have taken a number of samples from these forums and came up with this:

index=main sourcetype="WinEventLog:Security" "[insert userid]" | eval time=strftime(_time, "%m/%d/%y %H:%M:%S") | timechart span=1d earliest(time) as "Logon Time", latest(time) as "Logoff Time"

Unfortunately, the results start out fine but start to get way out of whack the closer to the current date you get. I have looked at the actual dates and times in the Events tab and the correct data is there, its just not displaying correctly. Here is an example of the output from the Statistics tab:

_time Logon Time Logoff Time
2014-05-24 05/24/14 15:00:37 05/24/14 15:00:37 <---bad
2014-05-25
2014-05-26
2014-05-27 05/27/14 09:14:06 05/27/14 17:12:41 <---good
2014-05-28 05/28/14 08:56:25 05/28/14 17:13:43 <---good
2014-05-29 05/29/14 09:02:37 05/29/14 17:06:44 <---good
2014-05-30 05/30/14 17:50:01 05/30/14 18:09:37 <---good
2014-05-31 05/31/14 11:44:14 05/31/14 11:57:16 <---good
2014-06-01
2014-06-02 06/02/14 17:47:17 06/02/14 18:11:13 <---good
2014-06-03 06/03/14 17:16:28 06/03/14 17:19:28 <---good
2014-06-04 06/04/14 17:02:42 06/04/14 17:12:14 <---good
2014-06-05 06/05/14 23:48:24 06/05/14 16:22:54 <---Starts getting weird right here
2014-06-06 06/06/14 23:50:00 06/06/14 23:50:00 <---bad
2014-06-07 06/07/14 13:05:48 06/07/14 13:05:48 <---bad
2014-06-08
2014-06-09
2014-06-10 06/10/14 22:44:30 06/10/14 22:44:30 <---bad
2014-06-11 06/11/14 16:18:01 06/11/14 16:18:01 <---bad
2014-06-12 06/12/14 16:55:23 06/12/14 16:55:23 <---bad
2014-06-13 06/13/14 18:08:19 06/13/14 18:08:19 <---bad
2014-06-14 06/14/14 13:06:34 06/14/14 13:06:34 <---bad
2014-06-15
2014-06-16 06/16/14 18:10:46 06/16/14 18:10:46 <---bad
2014-06-17 06/17/14 22:35:53 06/17/14 22:35:53 <---bad
2014-06-18 06/18/14 11:54:01 06/18/14 22:51:43 <---may be OK

Anyone have any ideas on getting the this to properly display the data?

[steveo69]

The Logfiller app also calculates and displays accurate Logon delay times...

[ppablo]

Logfiller App for Splunk page: http://apps.splunk.com/app/1800/

[somesoni2]

Give this a try

index=main sourcetype="WinEventLog:Security" "[insert userid]"  | eval time=_time| timechart span=1d min(time) as "Logon Time", max(time) as "Logoff Time" | convert  timeformat="%m/%d/%y %H:%M:%S" ctime(*)