Get Currently logged in Users

[ajebakumar]

Hi, 

I am building a dashboard for my application being monitored in Splunk. As part of this i am getting the timestamp  of the latest login and latest logout . Below is a Sample output i am getting with the query i have built (Query provided below). The Output i am looking in this case is AAA & CCC as RMID. Kindly suggest

RMID          LTIME                                                        OTIME

AAA           19-01-2021 10:55:32:002                19-01-2021 08:32:32:001

BBB           19-01-2021 11:50:12:002                19-01-2021 12:52:32:001

CCC           19-01-2021 10:55:32:002                

Below is the search query i have

index="XXX" kubernetes_namespace="uat" LoginStatus IN ("Authentication Success") | eventstats max(AuthenticationTime) as LoginTime  by RMID     |append  [search index="" kubernetes_namespace="uat" LoginStatus IN ("Logout Success") | eventstats max(AuthenticationTime) as LogoutTime  by RMID] |eventstats values(LoginTime) AS LTime, values(RMID) as RMID, values(LogoutTime) AS OTime | table  RMID, LTime, OTime | dedup RMID |eval  LoggedInTime = strptime(LoginTime,"%Y-%m-%d %H:%M:%S.%N") | eval  LoggedOutTime = strptime(OTime,"%Y-%m-%d %H:%M:%S.%N")

[scelikok]

Hi @ajebakumar,

You can filter like below;

index="XXX" kubernetes_namespace="uat" LoginStatus IN ("Authentication Success") 
| eventstats max(AuthenticationTime) as LoginTime by RMID 
| append 
    [ search index="" kubernetes_namespace="uat" LoginStatus IN ("Logout Success") 
    | eventstats max(AuthenticationTime) as LogoutTime by RMID] 
| eventstats values(LoginTime) AS LTime, values(RMID) as RMID, values(LogoutTime) AS OTime 
| fillnull value=0 OTime
| where OTime<LTime
| table RMID, LTime, OTime 
| dedup RMID 
| eval LoggedInTime = strptime(LoginTime,"%Y-%m-%d %H:%M:%S.%N") 
| eval LoggedOutTime = strptime(OTime,"%Y-%m-%d %H:%M:%S.%N")

If this reply helps you an upvote is appreciated.