How to create a report on Cisco ASA VPN Users including Username, VPN connection duration, Source IP, Start Time and End Time?

[kpsajin]

Hi,
We have a Cisco ASA which is sending syslog messages to Splunk for VPN traffic. I would like to know how to create a report with the following details.

Username, duration of the VPN connection, Source IP(Public IP), Start time and End time.

Has anyone created this report already? If yes, please share the search.

Regards
Sajin

[jfeitosa]

Try

... | rex field=Duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=dur_s+60*dur_m+3600*coalesce(dur_h,0) | stats sum(duration) as total_duration by Username

[ashutoshab]

Can you please elaborate, how this works and what logs we need to search.