Splunk Search

How can I create a query to separate every session by host based on specific field?

davidepala
Path Finder

Hi all,
i'm trying to record all RD session on my server, i've write this query:

index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction  Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd  | eval  duration = (duration* 1000)  |table  "_time" "host" "username" "EventType" duration

It works but I need to separate every session by host, in other words transaction must be evaluated only if the host value of the start event is the same of the end event.
thanks

0 Karma

mayurr98
Super Champion

Try this

index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction host Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd  | eval  duration = (duration* 1000)  |table  "_time" "host" "username" "EventType" duration
0 Karma

somesoni2
Revered Legend

Try adding host field into your transaction command.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...