Splunk Search

CurrentSessionLength TotalLoginLength in VMware Horizon Agent logs

user2020dy
Path Finder

Hello, guys,

I`m collecting logs from VMware Horizon client and here are 2 fields, the meaning of which I don`t clearly understand.

signal-2020-11-30-132004.jpeg

Is this length in seconds, minutes, hours?

 

And 2ond question: Maybe someone tried to calculate the session duration of Horizon logins and logons. Because here can be not only situations of simple logon and logoff , but also when the session was timed out and then the user reconnects. In ideal version I would like to check how many hours does the user spend using Horizon agent per day (to control working hours).

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @user2020dy may we know the SPL query please.

>>> Maybe someone tried to calculate the session duration of Horizon logins and logons.

the original logs does not have these? is it a new project you have joined? can you please share with us some sample logs.. 
how many team members are there? maybe you can directly ask them, or better, check the calculated fields/alias/tags/macros of all users.

there is a document "inherited deployments" that is good for understanding a new Splunk environment. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...