How to search users who had concurrent access on different PCs within the same logon and logoff period from my sample data set?

[hkhat5]

Sample data set

user, pc, logon, logoff, durationOfLogon
User11, HNA1E8I, 01-06-15 13:49:09, 01-06-15 13:49:11, 0:00:02
User138, HN2OTS12, 05-06-15 13:02:33, 05-06-15 13:02:36, 0:00:03
User160, H3NB3RA, 05-06-15 10:29:14, 05-06-15 10:29:16, 0:00:02
User174, HN4WF101, 03-06-15 11:55:43, 03-06-15 11:55:46, 0:00:03
User237, 3HND5,     01-06-15 11:00:21, 01-06-15 11:00:29, 0:00:08
User237, 3HND5I22, 01-06-15 11:00:22, 01-06-15 11:00:23, 0:00:01
User36, 4HNAE3I, 03-06-15 12:47:46, 03-06-15 12:47:48, 0:00:02
User379, 4HND5A, 03-06-15 11:19:40, 03-06-15 11:19:40, 0:00:00
User386, 4HNE4A, 07-06-15 16:33:51, 07-06-15 16:33:53, 0:00:02
User62, 6HNAE3I, 03-06-15 18:32:31, 03-06-15 18:32:34, 0:00:03 
User640, 34HNF4, 01-06-15 10:04:19, 01-06-15 10:04:21, 0:00:02 
User640, 5NF4, 04-06-15 16:04:18, 04-06-15 16:04:20, 0:00:02 
User747, NOCC01, 01-06-15 12:37:02, 01-06-15 12:37:03, 0:00:01
User747, 23NOCC03, 02-06-15 8:42:20, 02-06-15 8:42:26,  0:00:06
User747, ATPH02,     02-06-15 8:42:23,  02-06-15 8:42:25,   0:00:02
User790, 4HN2Y12, 03-06-15 15:29:33, 03-06-15 15:29:35, 0:00:02
User790, 3HNPHY02, 03-06-15 15:29:33, 03-06-15 15:29:40, 0:00:07

How can I create an search to find out the users with concurrent access on different PCs within the logon and logoff period?

Thanks

Kelvin

[dturnbull_splun]

You can do this by splitting each event into a logon event and a logoff event, assuming logon time is _time:

sourcetype=logons | eval count=1 | appendpipe [| eval _time = strptime(logoff, "%d-%m-%y %H:%M:%S") | eval count=-1] | sort + _time | streamstats sum(count) as concurrency by user global=f | where concurrency > 1 

[hkhat5]

Hi dturnbull,

Thanks for your reply.

However, the query seems not working on my situation. The result is not match when compare with the raw data. Here is the search query - "index=sample1 UserId!="User" | eval count=1 | appendpipe [ | eval _time = strptime(LogoffTime, "%d-%m-%Y %H:%M:%S") | eval count=-1 ] | sort + _time | streamstats sum(count) as concurrency by UserId global=f | where concurrency > 1 | table Site UserId WorkStationId LoginTime LogoffTime | sort 0 + Site"

The way i am using now is "JOIN", but this is very slow and i know might have some smart way to do it.

Thanks for your help

Kelvin