Report Cisco ASA VPN user usage

[jodelvalle]

Hi,

Let me start by saying that I just started using Splunk and I know little about how it works. However, I have a need to report VPN usage data ASAP. I found and modified the query shown below. It works great but I need to be able to show total duration per date. Currently it is adding all the time the VPN users has spent connected to the VPN since the system started collecting data.

Is it possible for the results to show Username, date and time of when they connected and the duration?
Is it possible to have that emailed to me every week?

Thanks in advance for your help.

JD

* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username

[mparks11]

Hi there, it depends on what your data look like, but you can add information into your stats reporting command in the "by" clause. Splunk should be calculating date_ fields that you could use, such as:

| stats sum(duration) as total_duration by Username, date_month, date_mday

You could also use the bucket/bin command to bucket time by day, which might work better to help calculate the duration by day then eval the duration calculation.

| bin _time span=1d