Get login duration from WinEventLogs

[Cstone1]

I've got tons and tons of logs.

What I want is login durations from the wineventlogs by usernames. Each event has the EventID and the username that caused it.

Lets say the username is "jbob"

So EventID=4624 is a login

EventID=4634 (disconnect/timeout) OR EventID=4647 (actual logoff).

How can I get the time from login id to one of the two logoff ids. For each login throughout the search window? They could log in and out 50 times in a day for example.

[thambisetty · Accepted solution]

There could be multiple logons and multiple logoffs for a single session but user may not aware of this (you could test this just by login and logoff in a minute). I am not sure why windows event logging is creating many.

Logon_ID is unique ID to track starting and ending of session.

The simplest way to identify duration between logon and logoff using Logon_ID would be something like below:

index=windows EventCode IN (4624,4634,4647) 
| stats earliest(_time) as earliestTime latest(_time) as latestTime range(_time) as duration by user,host,Logon_ID
| search user!=*$
| convert ctime("*Time") timeformat="%d/%m/%Y %T"

[Cstone1]

Thanks. 

I tried this is some slight mods and it appears to give me results. It's going to take some effort to verify the results and I'm not sure how its handling multiple logins at the moment. But for now its got me in the right direction.