Archive
Highlighted

Logon/Logoff Tracking

New Member

When performing user monitoring on behalf of HR or when requested by a supervisor (or performing forensics/investigations), we need a way to capture the first logon date/time and final logoff date/time each day. I have taken a number of samples from these forums and came up with this:

index=main sourcetype="WinEventLog:Security" "[insert userid]" | eval time=strftime(_time, "%m/%d/%y %H:%M:%S") | timechart span=1d earliest(time) as "Logon Time", latest(time) as "Logoff Time"

Unfortunately, the results start out fine but start to get way out of whack the closer to the current date you get. I have looked at the actual dates and times in the Events tab and the correct data is there, its just not displaying correctly. Here is an example of the output from the Statistics tab:

_time Logon Time Logoff Time
2014-05-24 05/24/14 15:00:37 05/24/14 15:00:37 <---bad
2014-05-25
2014-05-26
2014-05-27 05/27/14 09:14:06 05/27/14 17:12:41 <---good
2014-05-28 05/28/14 08:56:25 05/28/14 17:13:43 <---good
2014-05-29 05/29/14 09:02:37 05/29/14 17:06:44 <---good
2014-05-30 05/30/14 17:50:01 05/30/14 18:09:37 <---good
2014-05-31 05/31/14 11:44:14 05/31/14 11:57:16 <---good
2014-06-01
2014-06-02 06/02/14 17:47:17 06/02/14 18:11:13 <---good
2014-06-03 06/03/14 17:16:28 06/03/14 17:19:28 <---good
2014-06-04 06/04/14 17:02:42 06/04/14 17:12:14 <---good
2014-06-05 06/05/14 23:48:24 06/05/14 16:22:54 <---Starts getting weird right here
2014-06-06 06/06/14 23:50:00 06/06/14 23:50:00 <---bad
2014-06-07 06/07/14 13:05:48 06/07/14 13:05:48 <---bad
2014-06-08
2014-06-09
2014-06-10 06/10/14 22:44:30 06/10/14 22:44:30 <---bad
2014-06-11 06/11/14 16:18:01 06/11/14 16:18:01 <---bad
2014-06-12 06/12/14 16:55:23 06/12/14 16:55:23 <---bad
2014-06-13 06/13/14 18:08:19 06/13/14 18:08:19 <---bad
2014-06-14 06/14/14 13:06:34 06/14/14 13:06:34 <---bad
2014-06-15
2014-06-16 06/16/14 18:10:46 06/16/14 18:10:46 <---bad
2014-06-17 06/17/14 22:35:53 06/17/14 22:35:53 <---bad
2014-06-18 06/18/14 11:54:01 06/18/14 22:51:43 <---may be OK

Anyone have any ideas on getting the this to properly display the data?

Tags (2)
0 Karma
Highlighted

Re: Logon/Logoff Tracking

SplunkTrust
SplunkTrust

Give this a try

index=main sourcetype="WinEventLog:Security" "[insert userid]"  | eval time=_time| timechart span=1d min(time) as "Logon Time", max(time) as "Logoff Time" | convert  timeformat="%m/%d/%y %H:%M:%S" ctime(*)
Highlighted

Re: Logon/Logoff Tracking

Explorer

The Logfiller app also calculates and displays accurate Logon delay times...

0 Karma
Highlighted

Re: Logon/Logoff Tracking

Community Manager
Community Manager

Logfiller App for Splunk page: http://apps.splunk.com/app/1800/

0 Karma