Identify User Logged Out From Inactivity

[swsouth]

Hi all, we are looking at Splunk as a potential source to identify users that have long periods of inactivity. If there is no formal "logged out" or "timed out" message to queue on in the logs, would there be some way to determine time between last activity and then after a specified period of inactivity, the user is considered "logged out by inactivity" and added to a report that will be sent daily? Is this within Splunk's capabilities? If so, would this require any special scripting beyond a complex search?

I know this is pretty vague and I don't have a lot of specifics yet, but just wanted to throw it out and get some initial feedback. I'll provide updates as things progress.

Thanks

[dwaddle]

You can get close to this with some heuristics and use of the transaction command - specifically through the use of maxpause. The theory is that when a user is active, the result of that activity creates log entries. But, if they stop being active for the application's idle timeout (which you have to know), then they have in effect "logged out by inactivity".

The "logout time" can be loosely defined as "the last event + idle timeout"

So, a search something like:

sourcetype=webseal source=*/request.log 
| transaction maxpause=30m userid
| eval logout_time=_time + duration + (30 * 60)
| table userid, logout_time

would at least get you in the neighborhood.

[swsouth]

Somesoni2, this is for another application, not Splunk. Strive, the data is supposed to be provided from the WebSEAL logs (specifically, request.log). They initially identified userid, IP, log in/out time, last activity time as the required info.

[strive]

To add to what somesoni2 has asked for, if it is some other application's data indexed in splunk and if the log files contain the minimum required information then it is possible to generate the report that you are asking for. Whether a script is required or a splunk search is sufficient depends on the data granularity present in log events.

[somesoni2]

This information is for Splunk itself (splunk web usage by users) or any other application whose data in indexed in splunk?