Splunk Search

How to find concurrent VPN users per hour?

Motivator

We are using pulse secure as our VPN solution and I'm looking to build a search that tracks concurrent users per hour. Using my account as a test, I see the first event starts with, "Primary authentication successful for" and ends with "Closed connection" so based on that I created the following search:

index=foo 
| transaction startswith="Primary authentication successful for*" endswith="Closed connection*"
| eval count=1 
| timechart per_hour(eval(count)) as "Concurrent Users"

Is this a valid search for concurrent users?

Thx

0 Karma
1 Solution

Explorer

So I actually found a pretty simple solution for this.
You can enable "Event" logs from the VPN appliance to by syslogged (or Universal Forwarded) to your Splunk instance. Part of the Event logs are that every hour on the hour, it will generate a log entry for number of concurrent users and number of NCP connections. Now, I can just look for the log entry every hour and plot the concurrent users. The Pulse Secure App for Splunk automatically field extracted this information for me.

Very simple query for a line chart:
index=XXX concurrentusers="*" | table _time, concurrentusers

View solution in original post

Explorer

So I actually found a pretty simple solution for this.
You can enable "Event" logs from the VPN appliance to by syslogged (or Universal Forwarded) to your Splunk instance. Part of the Event logs are that every hour on the hour, it will generate a log entry for number of concurrent users and number of NCP connections. Now, I can just look for the log entry every hour and plot the concurrent users. The Pulse Secure App for Splunk automatically field extracted this information for me.

Very simple query for a line chart:
index=XXX concurrentusers="*" | table _time, concurrentusers

View solution in original post

Motivator

Awesome - thx so much!

0 Karma

Motivator

@cnmccown - I did not as I get lower numbers as well

0 Karma

Explorer

Alright - thanks for the response. I'll let you know if I get a query worked out.

0 Karma

Motivator

Would greatly appreciate it.

0 Karma

Explorer

Did you get a good query working for your Pulse Secure VPN? I'm working on this as well. Everything I try gives me lower numbers than what the appliance shows in the concurrent users.

0 Karma

Builder

One solution is to use the concurrency command. You'll need to calculate your duration.

(your search)
| eval duration=(VPN session duration in minutes)
| eval new_start = _time - duration
| concurrency start=new_start duration=duration output=overlap
| timechart span=1h max(overlap)

You can change your timechart span to fit your need.

Here is the concurrency man page: https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Concurrency

Motivator

Thx for the reply and info. The transaction command automatically created the duration field with values so I tried the following search:

index=foo 
| transaction startswith="Primary authentication successful for*" endswith="Closed connection*" 
| eval new_start = _time - duration 
| concurrency start=new_start duration=duration output=overlap 
| timechart span=1h max(overlap)

but the number of concurrent users is too low and not lining up

Thx

0 Karma

Builder

The transaction command is not good for large volumes, and I have had issues with it. Some people will recommend using the stats command like this, assuming you have a unique identifier to group by:

(your search here)
| eval StartTime=if(match(_raw, "start_pattern"), _time, null())
| eval EndTime=if(match(_raw, "end_pattern"), _time, null())
| stats earliest(StartTime) as StartTime latest(EndTime) as EndTime by vpnID
| eval elapsed=EndTime-StartTime

At this point, you should be able to get a nice tabular view that can help with verifying your data, prior to moving on with concurrency.

0 Karma