Cisco ASA Timechart

[jmaple]

I'm looking to create a timechart of VPN sessions that shows the number of users logged on over the course of a 24 hour period. The problem is I want the count to stay up until the logoff/timeout event occurs for that user. I can easily create the list of users that are currently logged on and I'm using that as my starting point. NOTE: I've created the event type of "vpn_session_event" which looks at level 6 events in the Cisco ASA.

eventtype=vpn_session_event  | transaction fields="user" maxspan=12h30m connected=f startswith="*connection established*"  | search eventtype!=cisco_vpn_end | dedup user

This will produce the list of current users, Now I need to chart this over time to get a count of how many user sessions were started over the course of the day dropping the number when the disconnect event occurs to show peak usage. Anyone have a technique for this?

[woodcock]

You need the concurrency command:
http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Concurrency

Also, ditch the transaction command first:
http://wiki.splunk.com/Virtual_.conf#March_2016

[user12345a_2]

We do something similar with our firewalls, tracking the number of sessions that are active. Adding timechart count(connect_id) for us charts the number of action connections over a given period of time and shows the peak during the day.

 eventtype=vpn_session_event  
| transaction fields="user" maxspan=12h30m connected=f startswith="*connection established*"  
| search eventtype!=cisco_vpn_end 
| dedup user
| **timechart count(user)**