All Apps and Add-ons

Logon/Logoff Tracking

Paladium
New Member

When performing user monitoring on behalf of HR or when requested by a supervisor (or performing forensics/investigations), we need a way to capture the first logon date/time and final logoff date/time each day. I have taken a number of samples from these forums and came up with this:

index=main sourcetype="WinEventLog:Security" "[insert userid]" | eval time=strftime(_time, "%m/%d/%y %H:%M:%S") | timechart span=1d earliest(time) as "Logon Time", latest(time) as "Logoff Time"

Unfortunately, the results start out fine but start to get way out of whack the closer to the current date you get. I have looked at the actual dates and times in the Events tab and the correct data is there, its just not displaying correctly. Here is an example of the output from the Statistics tab:

_time Logon Time Logoff Time
2014-05-24 05/24/14 15:00:37 05/24/14 15:00:37 <---bad
2014-05-25
2014-05-26
2014-05-27 05/27/14 09:14:06 05/27/14 17:12:41 <---good
2014-05-28 05/28/14 08:56:25 05/28/14 17:13:43 <---good
2014-05-29 05/29/14 09:02:37 05/29/14 17:06:44 <---good
2014-05-30 05/30/14 17:50:01 05/30/14 18:09:37 <---good
2014-05-31 05/31/14 11:44:14 05/31/14 11:57:16 <---good
2014-06-01
2014-06-02 06/02/14 17:47:17 06/02/14 18:11:13 <---good
2014-06-03 06/03/14 17:16:28 06/03/14 17:19:28 <---good
2014-06-04 06/04/14 17:02:42 06/04/14 17:12:14 <---good
2014-06-05 06/05/14 23:48:24 06/05/14 16:22:54 <---Starts getting weird right here
2014-06-06 06/06/14 23:50:00 06/06/14 23:50:00 <---bad
2014-06-07 06/07/14 13:05:48 06/07/14 13:05:48 <---bad
2014-06-08
2014-06-09
2014-06-10 06/10/14 22:44:30 06/10/14 22:44:30 <---bad
2014-06-11 06/11/14 16:18:01 06/11/14 16:18:01 <---bad
2014-06-12 06/12/14 16:55:23 06/12/14 16:55:23 <---bad
2014-06-13 06/13/14 18:08:19 06/13/14 18:08:19 <---bad
2014-06-14 06/14/14 13:06:34 06/14/14 13:06:34 <---bad
2014-06-15
2014-06-16 06/16/14 18:10:46 06/16/14 18:10:46 <---bad
2014-06-17 06/17/14 22:35:53 06/17/14 22:35:53 <---bad
2014-06-18 06/18/14 11:54:01 06/18/14 22:51:43 <---may be OK

Anyone have any ideas on getting the this to properly display the data?

Tags (2)
0 Karma

steveo69
Explorer

The Logfiller app also calculates and displays accurate Logon delay times...

0 Karma

ppablo
Retired

Logfiller App for Splunk page: http://apps.splunk.com/app/1800/

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=main sourcetype="WinEventLog:Security" "[insert userid]"  | eval time=_time| timechart span=1d min(time) as "Logon Time", max(time) as "Logoff Time" | convert  timeformat="%m/%d/%y %H:%M:%S" ctime(*)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...