Splunk Search

How can I get total duration of time for which each user logged in to splunk for this month.

jitendragupta
Path Finder

We have many users using splunk dashboards and we want to know total time for a user logged in to splunk system for this month.
Using different query I am able to know the list of users, their last login or logout and dashboards accessed by them. But I am facing problem to calculate total time he or she logged in for entire month. In other words duration for which used my system.

Tags (1)
0 Karma

jitendragupta
Path Finder

Thanks dude for this query . It helped me and I am exploring more using this.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jitendragupta,
I use this search to list all connections, see if it answers to your need.

index=_internal sourcetype=splunkd_ui_access user!="-"    
| stats earliest(_time) AS StartTime latest(_time) AS EndTime count by user date_mday    
| join type=left user         [        
     | rest /services/authentication/users                
     | rex field=id "https:\/\/127.0.0.1:8089\/(\w+\/)+(?<user>\w+)"                
     | rename realname AS Name               
     | fields user Name
      ]    
| search Name=*    
| eval         
     Duration=tostring(EndTime-StartTime,"Duration"),        
     StartTime=strftime(StartTime,"%d/%m/%Y %H.%M.%S"),        
     EndTime=strftime(EndTime,"%d/%m/%Y %H.%M.%S")    
| sort Name
| table Name StartTime EndTime Duration

Bye.
Giuseppe

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...