Splunk Search

How can I create a query to separate every session by host based on specific field?

Path Finder

Hi all,
i'm trying to record all RD session on my server, i've write this query:

index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction  Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd  | eval  duration = (duration* 1000)  |table  "_time" "host" "username" "EventType" duration

It works but I need to separate every session by host, in other words transaction must be evaluated only if the host value of the start event is the same of the end event.
thanks

0 Karma

SplunkTrust
SplunkTrust

Try this

index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction host Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd  | eval  duration = (duration* 1000)  |table  "_time" "host" "username" "EventType" duration
0 Karma

SplunkTrust
SplunkTrust

Try adding host field into your transaction command.

0 Karma