Is there a way in the app to modify the user reports by time to include logoff time? I am looking to find out both logon and logoff times for users.
Thanks
Janet
There is not a Logoff field available. However, we can write a search to get session duration (active, disconnected, etc.).
Here is an example to get Disconnected session duration. You can modify to get active as well:
index=xenapp sourcetype=xenapp:*:session State="Disconnected" | dedup ServerName SessionId | sort - CurrentTime | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(CurrentTime) mkTime(DisconnectTime) | eval DisconnectDuration = tostring(CurrentTime - DisconnectTime, "duration") | table LogOnTime UserName ServerName SessionId DisconnectDuration | rename DisconnectDuration AS "Disconnect Duration"
How do you go about writing the search to get session duration? I need to know when someone logs on then how long they are in a session?
Thanks
Janet