Splunk Enterprise

Splunk Query for Search Query/Alert

Path Finder


I need Avg time spent on login and logout by the user and want to calculate from the time they logged in and then out and then the total to show.

Need a query for this: Average time spent on the Platform by Users?

Example: each user spent how much time on work per day.

sourcetype="%forge%" source="/home/amadmin/log/authentication.audit.json" eventName=AM-LOGIN-COMPLETED OR eventName=AM-LOGOUT userId=*

Labels (1)
0 Karma


@phanichintha here is an example of how it can be achieved using the transaction command.

| makeresults
| eval _raw = "time, userID, eventName
20/07/2020 09:00:00, 1, AM-LOGIN-COMPLETED
20/07/2020 09:01:00, 2, AM-LOGIN-COMPLETED
20/07/2020 09:10:00, 2, AM-LOGOUT
20/07/2020 09:06:00, 1, AM-LOGOUT
20/07/2020 09:00:00, 3, AM-LOGIN-COMPLETED
20/07/2020 10:06:00, 3, AM-LOGOUT"
| multikv forceheader=1
| eval _time = strptime(time,"%d/%m/%Y %H:%M:%S")
| transaction userID maxspan=1d
| stats avg(duration) as AverageTimeSpentOnThePlatform


Here is the link to the command 

You can make it more robust by using the startswith and endwith arguments

Hope this helps

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...