Splunk Search

Get login duration from WinEventLogs

Cstone1
Engager

I've got tons and tons of logs.

What I want is login durations from the wineventlogs by usernames. Each event has the EventID and the username that caused it.

Lets say the username is "jbob"

So EventID=4624 is a login

EventID=4634 (disconnect/timeout) OR EventID=4647 (actual logoff).

How can I get the time from login id to one of the two logoff ids. For each login throughout the search window? They could log in and out 50 times in a day for example.

 

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

There could be multiple logons and multiple logoffs for a single session but user may not aware of this (you could test this just by login and logoff in a minute). I am not sure why windows event logging is creating many.

Logon_ID is unique ID to track starting and ending of session.

The simplest way to identify duration between logon and logoff using Logon_ID would be something like below:

index=windows EventCode IN (4624,4634,4647) 
| stats earliest(_time) as earliestTime latest(_time) as latestTime range(_time) as duration by user,host,Logon_ID
| search user!=*$
| convert ctime("*Time") timeformat="%d/%m/%Y %T"

 

 

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

There could be multiple logons and multiple logoffs for a single session but user may not aware of this (you could test this just by login and logoff in a minute). I am not sure why windows event logging is creating many.

Logon_ID is unique ID to track starting and ending of session.

The simplest way to identify duration between logon and logoff using Logon_ID would be something like below:

index=windows EventCode IN (4624,4634,4647) 
| stats earliest(_time) as earliestTime latest(_time) as latestTime range(_time) as duration by user,host,Logon_ID
| search user!=*$
| convert ctime("*Time") timeformat="%d/%m/%Y %T"

 

 

 

 

————————————
If this helps, give a like below.
0 Karma

Cstone1
Engager

Thanks. 

 

I tried this is some slight mods and it appears to give me results. It's going to take some effort to verify the results and I'm not sure how its handling multiple logins at the moment. But for now its got me in the right direction.

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...