Splunk Search

How to write searches for these specific use cases for my data?

New Member

Below is the log format 😞 log sample)

   ID      swipe_status               date                  time                    location
362558     SwipeIn                    2017-01-01            05:00:00.466            USA

Index = Swipe_index

  1. Total time between the swipe in & the swipe out for a user 1.1. List of users who were present in the organization for '9' or more than '9' hrs. (i.e. Time between swipe in and swipe out >= 9 hrs)
  2. List of users who have multiple instances of swipein & swipeout 2.1. Total time between first swipe in and last swipe out for all users who have multiple instances of swipe-in & swipe- out 2.2. List of users whose total time between first swipe in and last swipe out is '9' or more than '9' hrs 2.3. List of users whose total time between first swipe in and last swipe out is less than '9' hrs
  3. List of users who have requested an access on weekends
Tags (2)
0 Karma
1 Solution

Builder

Really hard to explain without the relevant data. However:

All your queries can be written using "transaction" command. https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction

  • You are looking at bundling your results using transaction command by EmployeeID. Transaction command gives you the duration automatically. Something like this index = Swipe_index | transaction EmployID maxevents=-1 maxspan=-1 startswith = "SwipeIn" keeporphans=true | where duration > 540 (for 9 hours time) ... etc;

View solution in original post

0 Karma

Builder

Really hard to explain without the relevant data. However:

All your queries can be written using "transaction" command. https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction

  • You are looking at bundling your results using transaction command by EmployeeID. Transaction command gives you the duration automatically. Something like this index = Swipe_index | transaction EmployID maxevents=-1 maxspan=-1 startswith = "SwipeIn" keeporphans=true | where duration > 540 (for 9 hours time) ... etc;

View solution in original post

0 Karma