Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- time start and time end
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
time start and time end
im doing a username search and i want two fields in my results table to be the time the user sarted the connection and also when they disconnected the session to the network. What is this information classified as, and wat field would it be called?
thanks
happy splunking
blake
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
im searching sys logs, on a windows system....ive also read through the documentation text with no success so far. I want to show a connection start and end time in a form search results field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
???????????????
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The problem is there is not enough information to help you with your question. What are type of system are they connecting to? Unix, Windows...
Also have you had a chance to go through the knowledgebase?
http://www.splunk.com/base/Documentation/latest/User/HowSearchCommandsWork
http://www.splunk.com/base/Documentation/4.1.3/Knowledge/Aboutfields
http://www.splunk.com/base/Documentation/latest/User/SearchExamples
Here a few that may help.
Travis.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What sourcetype are you searching?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
so people will click minus one but cant answer a simple question. This site really is disappointing me
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
