Getting Data In

How can I calculate session duration?

lorscardala985
Explorer

I wanted to know how I can calculate the average daily duration of the sessions

Labels (1)
0 Karma

lorscardala985
Explorer

i need to knwo how to find the average session duration  (the time between when I connect to when I disconnect)

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Take the time you connect away from the time you disconnect and that gives you how long you were connected. Do this for all the sessions to get the durations. Add these together and divide by the number of sessions. This gives you the average duration.

0 Karma

lorscardala985
Explorer

where i can find it??, i'm new in splunk so i don't know everything

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some of the events you have already in Splunk

0 Karma

lorscardala985
Explorer

index=_audit sourcetype=audittrail (action="login attempt" OR action="logout")
| stats values(_time) as action_time by user, action
| eventstats range(action_time) as range by user
| eventstats min(action_time) as min_time max(action_time) as max_time by user, range
| where action="login attempt" OR action="logout"
| stats values(action_time) as action_time by user
| eval login_time=mvindex(action_time, 0), logout_time=mvindex(action_time, -1)
| eval session_duration=logout_time - login_time
| eval session_duration_str=strftime(session_duration, "%H:%M:%S")
| table user session_duration_str

from this search I would need to know the duration of the individual days

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what you are trying to do with that search but I suspect it is not giving you the results you are after?

Supposed you have events which have a time field (_time), an action field ("login attempt" or "logout") and a user field

| sort 0 _time
| streamstats global=f last(action) as previous_action last(_time) as previous_time current=f by user
| where action="logout" and previous_action="login attempt"
| eval duration=_time-previous_time
| bin _time span=1d
| stats avg(duration) as average_duration by _time user
0 Karma

lorscardala985
Explorer

I thought of something like this :

index="_internal" | stats avg(_time) as avg_time by user | eval avg_day = strftime(avg_time, "%Y-%m-%d")

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

_time is the timestamp of the event. Taking an average of a timestamp will just give you a timestamp of a point in time between the first logon and the last log out.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please be more specific.  What sessions?  What defines the beginning and end of the session?

Be aware that some "sessions" may be indeterminate.   For example, web-based services (like Splunk) may have login events, but no logoff events that would establish a session.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What sort of events are you dealing with?

Please share some anonymised samples.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...