Good morning. I hope you can help.
I have been tasked with creating a chart for the top 25 users who spend the longest accumulated duration on our VPN sessions over a timespan of 7 days.
host=hostname* sourcetype="WinEventLog:System" EventCode=20272 | rex field=Message ": The user (?<user>\S+)"| rex field=_raw " The user was active for (?<sess_len_min>\d+) minutes (?<sess_len_secs>\d+)" | eval Total_Sess_Len = sess_len_min*60 + sess_len_secs | stats sum(Total_Sess_Len) as TotalSession by user | sort 25 -TotalSession | eval TotalSession = tostring(TotalSession, "duration")
The problem that I have is that if I search this over a period of 60 minutes, then a user's session may have STARTED before the timespan search and therefore returns a duration of longer than 60 minutes which based over a week's search would not give accurate results.
I understand that you can keep orphan events, but again, this would not give an accurate reflection of all session durations based over a set time period if sessions start or end either side of the time boundaries.
Any help that you could offer would be greatly appreciated.
Let me see if I get this right:
If that's what you are trying to achieve then you will need to:
Hope that's clear enough
That is exactly it! Thank you so much for your help Javier. Very much appreciated.