How to calculate Splunk session for a user ?

[vikas_gopal]

Hi Experts,

I want to create a report for last 24 hours which provides the information like how many hours users was on splunk in past 24 hours , or in other words how many hours user spent on Splunk .

Output will be like

User            Number of hours 
Admin                  10
test                    5
abc                     6

Regards
VG

[adonio]

i think, and i might be wrong, that splunk does not record a logoff event, so its not an easy task ...
you can search the _audit and _internal indexes to check on users and what they are doing as well as logon time
here are couple answers around this topic:
https://answers.splunk.com/answers/226555/how-to-find-how-many-users-are-logged-into-splunk.html
https://answers.splunk.com/answers/3768/how-do-you-find-out-who-is-logged-onto-splunk-right-now.html

hope it helps

[vikas_gopal]

Thank you Adonio for your quick response and you are absolutely correct from single index it is not possible so i have checked both _internal and _audit and I have prepared below query . Somehow this is not working any help here please

index=_audit sourcetype=audittrail user=admin action=log*  |dedup action, user|append [|search index=_internal sourcetype=splunk_web_service user=admin action=log* | stats count by user action status] |transaction user startswith=eval(action="login attempt") endswith=eval(action="logout") | table  user action status info duration

[adonio]

i can help you with the query, but i suspect it wont be useful as splunk captures a "logout" event only when you click logout. if you close your tab, or let the session timeout, i suspect splunk will not record it.
another reason it will be tough to sum up the duration of session is that you dont have a unique session / transaction id to group by. so for every user that logs in more then one time, it gets pretty challenging

[vikas_gopal]

Totally agreed , I have observed the same with the data. Well thanks for all the efforts , I will keep this question as unanswered . Let's see what others think about this .