How to write searches for these specific use cases for my data?

[Nayakstar]

Below is the log format 😞 log sample)

   ID      swipe_status               date                  time                    location
362558     SwipeIn                    2017-01-01            05:00:00.466            USA

Index = Swipe_index

1. Total time between the swipe in & the swipe out for a user 1.1. List of users who were present in the organization for '9' or more than '9' hrs. (i.e. Time between swipe in and swipe out >= 9 hrs)
2. List of users who have multiple instances of swipein & swipeout 2.1. Total time between first swipe in and last swipe out for all users who have multiple instances of swipe-in & swipe- out 2.2. List of users whose total time between first swipe in and last swipe out is '9' or more than '9' hrs 2.3. List of users whose total time between first swipe in and last swipe out is less than '9' hrs
3. List of users who have requested an access on weekends

[nabeel652 · Accepted solution]

Really hard to explain without the relevant data. However:

All your queries can be written using "transaction" command. https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction

• You are looking at bundling your results using transaction command by EmployeeID. Transaction command gives you the duration automatically. Something like this index = Swipe_index | transaction EmployID maxevents=-1 maxspan=-1 startswith = "SwipeIn" keeporphans=true | where duration > 540 (for 9 hours time) ... etc;