Login dashboard thats too complex for me

[williamsmew]

I need to create a search string that shows the first interactive logon of the specified account and then the final logoff of the day for the same account. This is beyond me, ANY help is appreciated.

I am positive this is going to expand into a dashboard request showing all users in the office.

I probably have the wrong tags on it, no idea where this should go.

[gcusello]

Hi williamsmew,
are you speaking about Windows audit logs or application logs?
If Windows, there's a problem because Windows audit logs are very many and search is very slow (a Windows user login generates around 10-12 login/logout events and it's repeted many times in a connection!).

Anyway, the approach should be the following:

• identify login and logout events (e.g. in windows login is Eventcode=4624 and logout is EventCode=2634),
• then identify username field (e.g. in Windows is user),

• ther run a search like the following (in Windows):

  index=wineventlog (EventCode=4624 OR EventCode=4634)
  | stats earliest(_time) AS earliest latest(_time) AS latest count BY user
  In this way you have the first login and the last logout in a time period.

Bye.
Giuseppe

[woodcock]

Show us your login and logout events.

[richgalloway]

What have you tried so far?