How can I get total duration of time for which each user logged in to splunk for this month.

[jitendragupta]

We have many users using splunk dashboards and we want to know total time for a user logged in to splunk system for this month.
Using different query I am able to know the list of users, their last login or logout and dashboards accessed by them. But I am facing problem to calculate total time he or she logged in for entire month. In other words duration for which used my system.

[jitendragupta]

Thanks dude for this query . It helped me and I am exploring more using this.

[gcusello]

Hi jitendragupta,
I use this search to list all connections, see if it answers to your need.

index=_internal sourcetype=splunkd_ui_access user!="-"    
| stats earliest(_time) AS StartTime latest(_time) AS EndTime count by user date_mday    
| join type=left user         [        
     | rest /services/authentication/users                
     | rex field=id "https:\/\/127.0.0.1:8089\/(\w+\/)+(?<user>\w+)"                
     | rename realname AS Name               
     | fields user Name
      ]    
| search Name=*    
| eval         
     Duration=tostring(EndTime-StartTime,"Duration"),        
     StartTime=strftime(StartTime,"%d/%m/%Y %H.%M.%S"),        
     EndTime=strftime(EndTime,"%d/%m/%Y %H.%M.%S")    
| sort Name
| table Name StartTime EndTime Duration

Bye.
Giuseppe