Getting Data In

How can I calculate session duration?

lorscardala985
Explorer

I wanted to know how I can calculate the average daily duration of the sessions

Labels (1)
0 Karma

lorscardala985
Explorer

i need to knwo how to find the average session duration  (the time between when I connect to when I disconnect)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Take the time you connect away from the time you disconnect and that gives you how long you were connected. Do this for all the sessions to get the durations. Add these together and divide by the number of sessions. This gives you the average duration.

0 Karma

lorscardala985
Explorer

where i can find it??, i'm new in splunk so i don't know everything

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some of the events you have already in Splunk

0 Karma

lorscardala985
Explorer

index=_audit sourcetype=audittrail (action="login attempt" OR action="logout")
| stats values(_time) as action_time by user, action
| eventstats range(action_time) as range by user
| eventstats min(action_time) as min_time max(action_time) as max_time by user, range
| where action="login attempt" OR action="logout"
| stats values(action_time) as action_time by user
| eval login_time=mvindex(action_time, 0), logout_time=mvindex(action_time, -1)
| eval session_duration=logout_time - login_time
| eval session_duration_str=strftime(session_duration, "%H:%M:%S")
| table user session_duration_str

from this search I would need to know the duration of the individual days

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what you are trying to do with that search but I suspect it is not giving you the results you are after?

Supposed you have events which have a time field (_time), an action field ("login attempt" or "logout") and a user field

| sort 0 _time
| streamstats global=f last(action) as previous_action last(_time) as previous_time current=f by user
| where action="logout" and previous_action="login attempt"
| eval duration=_time-previous_time
| bin _time span=1d
| stats avg(duration) as average_duration by _time user
0 Karma

lorscardala985
Explorer

I thought of something like this :

index="_internal" | stats avg(_time) as avg_time by user | eval avg_day = strftime(avg_time, "%Y-%m-%d")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

_time is the timestamp of the event. Taking an average of a timestamp will just give you a timestamp of a point in time between the first logon and the last log out.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please be more specific.  What sessions?  What defines the beginning and end of the session?

Be aware that some "sessions" may be indeterminate.   For example, web-based services (like Splunk) may have login events, but no logoff events that would establish a session.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What sort of events are you dealing with?

Please share some anonymised samples.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...