How to create sleep time of Windows PC calculation into timechart?

[skovachev]

Hi,  I am using following search into Windows EventViewer System logs  that I extracted for testing:

index="503461" host="hp-laptop" "Sleep Time"

 Log looks like below:

Information,4.2.2022 г. 12:55:47,Microsoft-Windows-Power-Troubleshooter,1,None,"The system has returned from a low power state.

Sleep Time: ‎2022‎-‎02‎-‎04T10:38:18.391571900Z
Wake Time: ‎2022‎-‎02‎-‎04T10:55:46.701556600Z

Wake Source: Device -USB Composite Device"

I am trying to calculate the two time stamps into total duration. Can someone help with the search string, thank you 🙂

[VatsalJagani]

Easy:

index="503461" host="hp-laptop" "Sleep Time"
| rex field=Sleep_Time max_match=0 "(?<test>[\w:\.\-]+)" | eval Sleep_Time = mvjoin(test, "")
| rex field=Wake_Time max_match=0 "(?<test2>[\w:\.\-]+)" | eval Wake_Time = mvjoin(test2, "")
| eval Sleep_Time2=strptime(Sleep_Time, "%FT%T.%9QZ")
| eval Wake_Time2=strptime(Wake_Time, "%FT%T.%9QZ")
| eval Duration=Wake_Time2-Sleep_Time2

* line-2 and line-3 are to remove special characters from the _raw time as what I saw in case.

* line-3 and line-4 convert the string time format to an epoch number.

* line-5 calculate the duration in seconds (floating point number) 

[skovachev]

HI Vatsa,

Thank you for the time you spent with my problem. I am unable to figure out the regex.

I am trying another scenario now where I calculate the Scree Locked time minus the screen Unlock time so I can get total duration of screen was locked on a windows pc. Here are the logs and what I managed to put together so far.

Information,Audit Success,11.2.2022 г. 13:51:11,Microsoft-Windows-Security-Auditing,4800,Other Logon/Logoff Events,Security,"The workstation was locked.

Information,Audit Success,11.2.2022 г. 13:51:19,Microsoft-Windows-Security-Auditing,4801,Other Logon/Logoff Events,Security,"The workstation was unlocked.

index="........."
| rename EXTRA_FIELD_8 as message
| rename "Event ID" as eventid
| rename "Date and Time" as DT
| eval message=if((eventid=4800),"LOCKED", "UNLOCKED")
| table message,DT

I would appreciate any help with substracting Locked time from Unlock time and creating a Mon-Fri timechart that shows duration of a pc on screenlock 🙂

[VatsalJagani]

This is totally different scenario because in the original case you had both the information in a single event but here you have two events for two activities.

Try something like this:

index="........."
| eval message=if((eventid=4800),"LOCKED", "UNLOCKED")
| transaction maxevents=2 host startswith="message=LOCKED" endswith="message=UNLOCKED"

See you should have a duration field in the results now. If you are getting all negative values, interchange startswith with endswith in the transaction command. Or you can also take abs(duration) with eval, which will also convert negative values to positive values. Or you can also multiply by -1.

Once you have it you can do timechart or stats whatever you want to apply after that.

[VatsalJagani · Accepted solution]

Please accept the solution if the answer was helpful to you.