Splunk Search
Highlighted

Finding a Sessions Length

Hi All,
**
Summary
**
I have windows logs for remote VPN access. I want to be able to graph concurrent use by user. But the problem is : example - I have one log EventCode=123 which is a remote connection that occurs at 2pm for instance and EventCode=321 which is a disconnection that occurred at 5pm. Between the fields there are no logs so timecharting comes back with a 1 on 2pm and a 1 on 5pm but 0 on the hours between...I want to have a count on the hours between to show that the session was active. Is there a way to do this?

0 Karma
Highlighted

Re: Finding a Sessions Length

Explorer

Hello, I think you should use transaction command with username and startswith and endswith options.
... | transaction user startswith="EventCode=123" endswith="EventCode=321"
After that, you can use duration field in the result of transaction command to calculate session duration.

0 Karma
Highlighted

Re: Finding a Sessions Length

Ultra Champion
0 Karma