How do you capture login and logout times from the log?

[dinakar407]

Hi Splunk Experts,

We have the below log file

40312   [6]   DEBUG   2018-09-03 08:28:42.987   TM1.Login   Login attempt by client: user1
40312   [6]   DEBUG   2018-09-03 08:28:43.007   TM1.Login   Login Success: User user1
40312   [6]   DEBUG   2018-09-03 08:28:59.392   TM1.Login   Logout User user1

Could you please help me with the search command to extract login and log out time of any user.

I am looking for a table with Username LoginTime LogoutTime Duration.

Regards
Dinakar

[DEAD_BEEF · Accepted solution]

Hi @dinakar407, is this what you're looking for?

| makeresults 
| eval data="40312 [6] DEBUG 2018-09-03 08:28:42.987 TM1.Login Login attempt by client: user1;
 40312 [6] DEBUG 2018-09-03 08:28:43.007 TM1.Login Login Success: User user1;
 40312 [6] DEBUG 2018-09-03 18:13:40.136 TM1.Login Logout User user1" 
| makemv data delim=";" 
| mvexpand data 
| rename data as _raw 
| rex field=_raw "(?<loginTime>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}).*?Login Success: User (?<Username>.*)" 
| rex field=_raw "(?<logoutTime>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}).*?Logout User (?<Username>.*)" 
| reverse 
| transaction Username startswith="Login Success" endswith="Logout User" 
| eval login_e = strptime(loginTime, "%Y-%m-%d %T.%3Q") 
| eval logout_e = strptime(logoutTime, "%Y-%m-%d %T.%3Q") 
| eval Duration = strftime((logout_e - login_e), "%T.%3Q") 
| table Username loginTime logoutTime Duration

If you're looking to test it against your own data, just start with your initial search and then paste everything that starts with the rex row

| index=x sourcetype=x
| rex field=_raw "(?<loginTime>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}).*?Login Success: User (?<Username>.*)" 
| rex field=_raw "(?<logoutTime>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}).*?Logout User (?<Username>.*)" 
| reverse 
| transaction Username startswith="Login Success" endswith="Logout" 
| eval login_e = strptime(loginTime, "%Y-%m-%d %T.%3Q") 
| eval logout_e = strptime(logoutTime, "%Y-%m-%d %T.%3Q") 
| eval Duration = strftime((logout_e - login_e), "%T.%3Q") 
| table Username loginTime logoutTime Duration

[niketn]

@dinakar407, you can try transaction command

Following is a run anywhere search example based on your sample data which extracts user action as Login Success: and Logout, and then creates a transaction based on user field which contains user id. Commands from | makeresults to | reverse generate sample data. You can replace with your current search instead.

| makeresults
| eval data="40312 [6] DEBUG 2018-09-03 08:28:42.987 TM1.Login Login attempt by client: user1;
40312 [6] DEBUG 2018-09-03 08:28:43.007 TM1.Login Login Success: User user1;
40312 [6] DEBUG 2018-09-03 08:28:59.392 TM1.Login Logout User user1"
| makemv data delim=";"
| mvexpand data
| rename data as _raw
| rex "DEBUG (?<_time>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3})"
| eval _time=strptime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| reverse
| rex "Login (?<action>(Login Success:|Logout))\sUser (?<user>[^\s]+)"
| transaction user startswith="action=Login"  endswith="action=Logout" maxevents=2 keepevicted=t

PS: Depending on your use case stats/streamstats might work better than transaction. For example whether you want to pull the latest login/logout per use or all.