Splunk Enterprise

Logon Duration

itsmevic
Communicator

I'd like to get the logon/logoff duration times of just one user, what would be the best SPL to go with to determine this?  Any help is greatly appreciated! 

Labels (1)
0 Karma

itsmevic
Communicator

I found the answer below and it works great.  I just need to now convert the seconds to minutes.

index=* host=* user="username" sourcetype="WinEventLog:Security" EventCode="4624" OR EventCode=4634
| transaction user maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1
| eval Logontime=if(EventCode="4624",_time,null())
| eval Logofftime=Logontime+duration
| convert ctime(Logontime) as Logontime
| convert ctime(Logofftime) as Logofftime
| table host, src_nt_host, user, Logontime, Logofftime, duration
| sort user, host, -duration
| rename duration AS "Duration (seconds)"

 

bowesmana
SplunkTrust
SplunkTrust

@itsmevic 

Be aware that the transaction command may not always give you expected results, particularly if you're dealing with large data sets, as there are memory constraints. You are using maxspan=-1, which means that for every logon that has no logoff, Splunk has to keep that initial logon data in memory until it finds a logoff. It may not be an issue in this case, but worth noting. 

There are often easy alternatives to avoid using transaction that do not have the same constraints. See the 'Using stats instead of transaction' section here.

https://docs.splunk.com/Documentation/Splunk/8.1.1/Search/Abouttransactions

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
You could try eval/fieldformat duration = tostring(duration, “duration”)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You need to give an example of your data, saying how time, user and logon/logoff state can be identified to get a good answer

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...