Reporting

How to create a report on Cisco ASA VPN Users including Username, VPN connection duration, Source IP, Start Time and End Time?

kpsajin
Explorer

Hi,
We have a Cisco ASA which is sending syslog messages to Splunk for VPN traffic. I would like to know how to create a report with the following details.

Username, duration of the VPN connection, Source IP(Public IP), Start time and End time.

Has anyone created this report already? If yes, please share the search.

Regards
Sajin

jfeitosa
Path Finder

Try

... | rex field=Duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=dur_s+60*dur_m+3600*coalesce(dur_h,0) | stats sum(duration) as total_duration by Username
0 Karma

ashutoshab
Communicator

Can you please elaborate, how this works and what logs we need to search.

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...