Splunk Search

How to find concurrent VPN users per hour?

jwalzerpitt
Motivator

We are using pulse secure as our VPN solution and I'm looking to build a search that tracks concurrent users per hour. Using my account as a test, I see the first event starts with, "Primary authentication successful for*" and ends with "Closed connection*" so based on that I created the following search:

index=foo 
| transaction startswith="Primary authentication successful for*" endswith="Closed connection*"
| eval count=1 
| timechart per_hour(eval(count)) as "Concurrent Users"

Is this a valid search for concurrent users?

Thx

0 Karma
1 Solution

cnmccown
Explorer

So I actually found a pretty simple solution for this.
You can enable "Event" logs from the VPN appliance to by syslogged (or Universal Forwarded) to your Splunk instance. Part of the Event logs are that every hour on the hour, it will generate a log entry for number of concurrent users and number of NCP connections. Now, I can just look for the log entry every hour and plot the concurrent users. The Pulse Secure App for Splunk automatically field extracted this information for me.

Very simple query for a line chart:
index=XXX concurrent_users="*" | table _time, concurrent_users

View solution in original post

cnmccown
Explorer

So I actually found a pretty simple solution for this.
You can enable "Event" logs from the VPN appliance to by syslogged (or Universal Forwarded) to your Splunk instance. Part of the Event logs are that every hour on the hour, it will generate a log entry for number of concurrent users and number of NCP connections. Now, I can just look for the log entry every hour and plot the concurrent users. The Pulse Secure App for Splunk automatically field extracted this information for me.

Very simple query for a line chart:
index=XXX concurrent_users="*" | table _time, concurrent_users

jwalzerpitt
Motivator

Awesome - thx so much!

0 Karma

jwalzerpitt
Motivator

@cnmccown - I did not as I get lower numbers as well

0 Karma

cnmccown
Explorer

Alright - thanks for the response. I'll let you know if I get a query worked out.

0 Karma

jwalzerpitt
Motivator

Would greatly appreciate it.

0 Karma

cnmccown
Explorer

Did you get a good query working for your Pulse Secure VPN? I'm working on this as well. Everything I try gives me lower numbers than what the appliance shows in the concurrent users.

0 Karma

jpolvino
Builder

One solution is to use the concurrency command. You'll need to calculate your duration.

(your search)
| eval duration=(VPN session duration in minutes)
| eval new_start = _time - duration
| concurrency start=new_start duration=duration output=overlap
| timechart span=1h max(overlap)

You can change your timechart span to fit your need.

Here is the concurrency man page: https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Concurrency

jwalzerpitt
Motivator

Thx for the reply and info. The transaction command automatically created the duration field with values so I tried the following search:

index=foo 
| transaction startswith="Primary authentication successful for*" endswith="Closed connection*" 
| eval new_start = _time - duration 
| concurrency start=new_start duration=duration output=overlap 
| timechart span=1h max(overlap)

but the number of concurrent users is too low and not lining up

Thx

0 Karma

jpolvino
Builder

The transaction command is not good for large volumes, and I have had issues with it. Some people will recommend using the stats command like this, assuming you have a unique identifier to group by:

(your search here)
| eval StartTime=if(match(_raw, "start_pattern"), _time, null())
| eval EndTime=if(match(_raw, "end_pattern"), _time, null())
| stats earliest(StartTime) as StartTime latest(EndTime) as EndTime by vpnID
| eval elapsed=EndTime-StartTime

At this point, you should be able to get a nice tabular view that can help with verifying your data, prior to moving on with concurrency.

0 Karma