How can I create a query to separate every session by host based on specific field?

[davidepala]

Hi all,
i'm trying to record all RD session on my server, i've write this query:

index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction  Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd  | eval  duration = (duration* 1000)  |table  "_time" "host" "username" "EventType" duration

It works but I need to separate every session by host, in other words transaction must be evaluated only if the host value of the start event is the same of the end event.
thanks

[mayurr98]

Try this

index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction host Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd  | eval  duration = (duration* 1000)  |table  "_time" "host" "username" "EventType" duration

[somesoni2]

Try adding host field into your transaction command.