Splunk Search

How to report to see how much time a user spends on a PC?

vpatsalos
New Member

I have a search that captures when a user logs in and logs out of his PC:

index=win* (EventCode=4800 OR EventCode=4801) Account_Name=Batman
The results show the below consecutive events: (from top to bottom)

EventCode=4801  The workstation was unlocked. 
EventCode=4800 The workstation was locked.

EventCode=4801  The workstation was unlocked.
EventCode=4800 The workstation was locked.

EventCode=4801  The workstation was unlocked.
EventCode=4800 The workstation was locked.

Basically, I want to run a report each day (last 24 hours) where I can subtract the _time of first, second, third pair of events (duration) and then add the duration values together so it will show how long a user has not been on the computer.

Current search I have, finds the difference of the consecutive events. In the results I see the right time difference values but it also include wrong data as well which I cannot remove.

| delta _time p=1| rename delta(_time) AS timeDeltaS | eval timeDeltaS=abs(timeDeltaS) | eval "Duration"=tostring(timeDeltaS,"duration") | table Account_Name,_time, "Duration"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=win* (EventCode=4800 OR EventCode=4801) Account_Name=Batman
| streamstats current=f window=1 values(EventCode) as prevEC values(_time) as prev_time by Account_Name
| where EventCode=4800 AND prevEC=4801
| eval Duration=tostring(prev_time-_time,"duration)
| table Account_Name _time Duration
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...