Splunk Search

Finding a Sessions Length


Hi All,
I have windows logs for remote VPN access. I want to be able to graph concurrent use by user. But the problem is : example - I have one log EventCode=123 which is a remote connection that occurs at 2pm for instance and EventCode=321 which is a disconnection that occurred at 5pm. Between the fields there are no logs so timecharting comes back with a 1 on 2pm and a 1 on 5pm but 0 on the hours between...I want to have a count on the hours between to show that the session was active. Is there a way to do this?

0 Karma

0 Karma


Hello, I think you should use transaction command with username and startswith and endswith options.
... | transaction user startswith="EventCode=123" endswith="EventCode=321"
After that, you can use duration field in the result of transaction command to calculate session duration.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!