I have the transaction command running successfully to identify where users log on and log off from our HDI environment using two different log files that end up in the same index, but with different sourcetypes (LogOn or LogOff)
One feature of the HDI is they can move location and take there session with them.
This results in the IP address for the log off being different from the log on IP address.
I'm trying to work out how to identify the user that have moved location during a session
The _raw is the same for both LogOn and LogOff:
Date, time, server, username, IPaddress
The transaction works on the Username and the two different sourcetypes. This works fine and a typical transaction is:
2015/11/03, 23:23:00, ServerA, bobjones, 10.10.10.10
2015/11/03, 20:20:00, ServerA, bobjones, 10.10.10.10
IPAddress=10.10.10.10 | server=ServerA | sourcetype=LogOn sourcetype=LogOff |Username=bobjones
If Bob decides to move location during the day, his transaction look like this:
2015/11/02, 23:23:00, ServerA, bobjones, 10.10.10.20
2015/11/02, 20:20:00, ServerA, bobjones, 10.10.10.10
IPAddress=10.10.10.10 IPAddress=10.10.10.20 | server=ServerA | sourcetype=LogOn sourcetype=LogOff |Username=bobjones
The transaction is correct, but how can I report only on users who have different IP addresses within a transaction so I can post it to a dashboard?
Tried distinct counts to no avail because I need to dc within the transaction, not on the _raw.
Thanks
