How do you make a search that finds log in/log off times?

[yassy]

Good morning,

I'm doing a search to bring users and their first login of the day and their last logoff.

I made the following query but I cannot get the first line of the 4624 and the last one of the 4636 in the same line.

index=wineventlog (EventCode="4624" OR EventCode="4634")  Account_Name="Agustina.Sanabria"
| regex Account_Name!=".*\$"
| eval day=strftime(_time,"%d/%m/%Y")
| eval User=if(EventCode="4624",mvindex(Account_Name,1),Account_Name)
| stats earliest(_time) as PrimerLogin, latest(_time) as UltimoLogoff by User EventCode host day
| eval PrimerLogin=strftime(PrimerLogin,"%d/%m/%Y %H.%M.%S"), UltimoLogoff=strftime(UltimoLogoff,"%d/%m/%Y %H.%M.%S")
| sort User

Tks, sorry for my english

[macadminrohit]

Your line 4 is a problem, You need to split the Account_Name in order to use the mvindex . I tried with a dummy data set. Let me know if it works.

| makeresults 
| eval EventCode="4624 4634"  | eval host=host1
| makemv delim=" " EventCode 
| mvexpand EventCode 
| eval Account_Name="Agustina.Sanabria" 
| regex Account_Name!=".*\$" 
| eval day=strftime(_time,"%d/%m/%Y") 
| eval User=if(EventCode="4624",mvindex(split(Account_Name,"."),1),Account_Name) 
| stats earliest(_time) as PrimerLogin, latest(_time) as UltimoLogoff by User EventCode day host
| eval PrimerLogin=strftime(PrimerLogin,"%d/%m/%Y %H.%M.%S"), UltimoLogoff=strftime(UltimoLogoff,"%d/%m/%Y %H.%M.%S") 
| sort User

[muralikoppula]

Check this one:
https://answers.splunk.com/answers/403990/how-can-i-search-windows-security-events-to-track.html

[richgalloway]

I converted this from an answer to an old question into its own question.