Finding a Sessions Length

[celdridge1988]

Hi All,
**
Summary
**
I have windows logs for remote VPN access. I want to be able to graph concurrent use by user. But the problem is : example - I have one log EventCode=123 which is a remote connection that occurs at 2pm for instance and EventCode=321 which is a disconnection that occurred at 5pm. Between the fields there are no logs so timecharting comes back with a 1 on 2pm and a 1 on 5pm but 0 on the hours between...I want to have a count on the hours between to show that the session was active. Is there a way to do this?

[to4kawa]

https://answers.splunk.com/answers/811217/concurrent-active-vpn-sessions-on-a-timechart.html

This is a similar question.

I made the query. It's not easy. good luck.

but now, here is the app.

https://www.splunk.com/en_us/blog/leadership/introducing-splunk-remote-work-insights-our-solution-fo...

[jg91]

Hello, I think you should use transaction command with username and startswith and endswith options.
... | transaction user startswith="EventCode=123" endswith="EventCode=321"
After that, you can use duration field in the result of transaction command to calculate session duration.