I'll ask this question in two ways in hope I can convey my intentions properly:
When you log into this system, a login event is written to a log. When the user logs off (connection closed, etc), a logoff event is written to a log. Throughout the time the user is logged into the box, I don't have any logs to tie activity to a specific user.
I want to be able to have a timechart that displays the total amount of users concurrently logged into a system throughout the course of the day.
So, if my user ID logs in at 1PM and log off at 4PM, my timechart with a span= of say.. 1h, should tally a "1" for 1PM, 2PM, 3PM and 4PM.
1pm User1 Login 2pm User2 Login 3pm <no login/logoff activity> 4pm User1 Logoff 5pm User2 Logoff
Base on those events, I want to be able to construct a table/timechart/something that says:
12pm 0 Users 1pm 1 User 2pm 2 Users 3pm 2 Users 4pm 2 Users 5pm 1 User 6pm 0 Users
So far, I have the equivalent of this:
index=logins | transaction User startswith=action=logon endswith=action=logoff | timechart span=1h dc(User) by User
However, that only gives me a tally of 1 for each User only for the hour when the login event happened. The time between their initial login and logoff drops off.
I can skip the transaction.. but then I get the tally for the time the login happened, and the time the logoff happened, and still missing the in between.
More specific scenario...
The same thing as above applies, but if it is of any help, this is being done with Windows Event Logs.
My true search looks like this:
index=os host=<myhost> source="WinEventLog:Security" | lookup windows_event_descriptions EventCode | search EventCodeDescription="Successful Logon" OR EventCodeDescription="User Logoff" | transaction User startswith=EventCodeDescription="Successful Logon" endswith=EventCodeDescription="User Logoff"
Hm, not quite. It'll still not account for the hours in between the login and logoff events. I updated the original question with some better information..
Do you have the user list?
lookup for the events containing the user names and description as successful login attemps and second will have user and log offs. so it would be like
search 1 : user,logincount per hour join search 2: user, logoffcount per hour| userperhour=logincount-logoffcount
Give this a try
index=os host=<myhost> source="WinEventLog:Security" | lookup windows_event_descriptions EventCode | search EventCodeDescription="Successful Logon" OR EventCodeDescription="User Logoff" | eval cnt=if(EventCodeDescription="Successful Logon",1,-1) | makecontinuous _time span=15m | eval cnt=coalesce(cnt,0) | accum cnt | timechart span=1h max(cnt) as MaxConUser