Splunk Search

How to get active VPN Sessions Cisco ASA Logs with Datamodel?


Hello together,

I probe to get the active session count from our asa logs per minute.
I created a datamodel (CASA) which contains the username and also the session_duration field if the session is closed.
A session can only timeout after 15 minutes, if no packet arrives by the vpn gateway.
Also, a session can be active over years, so the correlation from session start and logout events are not possible.

Actually i had this:

| tstats 
estdc(ASA.Username) as UsrC
count(ASA.session_duration) as LogC
from datamodel=CASA where (nodename = ASA.VPN)
groupby _time, host
prestats=false span=15m | eval "Active Sessions"=UsrC - LogC

time  | host     | UsrC | LogC | Active Sessions
23:00 | vpnhost1 | 103  | 15   | 88
23:15 | vpnhost1 | 99   | 15   | 84
23:30 | vpnhost1 | 85   | 11   | 74
23:45 | vpnhost1 | 82   | 11   | 71

I think the solution would be that every minute he count and dedup the field ASA.Username for the last 15 minutes.
But actually, I have no idea to solve this.

Did anyone have a solution to my problem or need additional information to help?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...