Hi,
I am building a dashboard for my application being monitored in Splunk. As part of this i am getting the timestamp of the latest login and latest logout . Below is a Sample output i am getting with the query i have built (Query provided below). The Output i am looking in this case is AAA & CCC as RMID. Kindly suggest
RMID LTIME OTIME
AAA 19-01-2021 10:55:32:002 19-01-2021 08:32:32:001
BBB 19-01-2021 11:50:12:002 19-01-2021 12:52:32:001
CCC 19-01-2021 10:55:32:002
Below is the search query i have
index="XXX" kubernetes_namespace="uat" LoginStatus IN ("Authentication Success") | eventstats max(AuthenticationTime) as LoginTime by RMID |append [search index="" kubernetes_namespace="uat" LoginStatus IN ("Logout Success") | eventstats max(AuthenticationTime) as LogoutTime by RMID] |eventstats values(LoginTime) AS LTime, values(RMID) as RMID, values(LogoutTime) AS OTime | table RMID, LTime, OTime | dedup RMID |eval LoggedInTime = strptime(LoginTime,"%Y-%m-%d %H:%M:%S.%N") | eval LoggedOutTime = strptime(OTime,"%Y-%m-%d %H:%M:%S.%N")
Hi @ajebakumar,
You can filter like below;
index="XXX" kubernetes_namespace="uat" LoginStatus IN ("Authentication Success")
| eventstats max(AuthenticationTime) as LoginTime by RMID
| append
[ search index="" kubernetes_namespace="uat" LoginStatus IN ("Logout Success")
| eventstats max(AuthenticationTime) as LogoutTime by RMID]
| eventstats values(LoginTime) AS LTime, values(RMID) as RMID, values(LogoutTime) AS OTime
| fillnull value=0 OTime
| where OTime<LTime
| table RMID, LTime, OTime
| dedup RMID
| eval LoggedInTime = strptime(LoginTime,"%Y-%m-%d %H:%M:%S.%N")
| eval LoggedOutTime = strptime(OTime,"%Y-%m-%d %H:%M:%S.%N")
If this reply helps you an upvote is appreciated.