Splunk for Citrix XenApp Logoff times

[jmp13]

Is there a way in the app to modify the user reports by time to include logoff time? I am looking to find out both logon and logoff times for users.

Thanks

Janet

[jconger]

There is not a Logoff field available. However, we can write a search to get session duration (active, disconnected, etc.).

[jconger]

Here is an example to get Disconnected session duration. You can modify to get active as well:

index=xenapp sourcetype=xenapp:*:session State="Disconnected" | dedup ServerName SessionId | sort - CurrentTime | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(CurrentTime) mkTime(DisconnectTime) | eval DisconnectDuration = tostring(CurrentTime - DisconnectTime, "duration") | table LogOnTime UserName ServerName SessionId DisconnectDuration | rename DisconnectDuration AS "Disconnect Duration"

[jmp13]

How do you go about writing the search to get session duration? I need to know when someone logs on then how long they are in a session?

Thanks

Janet