Splunk Search

Logon session time

ghnwmlguy
Explorer

I am trying to gather average login session times for a server given multiple users logon and logoff log entries. I am using ossec to filter the logs first so standard windows fields may not apply, but I have extracted the user field (called "user").

I am not really sure where to start since I cannot seem to figure out how to gather average user session times for any time period given there are multiple users.

Any ideas?

Tags (2)
0 Karma
1 Solution

David
Splunk Employee
Splunk Employee

If you have the events that indicate logon and logoff, you could build a transaction and then grab the duration, a la:

YourSearch | transaction Username startswith=LogonEventID endswith=LogoffEventID 
           | eval DurationInMin = round(duration/60,2) 
           | stats avg(DurationInMin) as "Average Session Duration (Minutes)" by Username

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

View solution in original post

David
Splunk Employee
Splunk Employee

If you have the events that indicate logon and logoff, you could build a transaction and then grab the duration, a la:

YourSearch | transaction Username startswith=LogonEventID endswith=LogoffEventID 
           | eval DurationInMin = round(duration/60,2) 
           | stats avg(DurationInMin) as "Average Session Duration (Minutes)" by Username

http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

gkanapathy
Splunk Employee
Splunk Employee

Also, if there is a session ID (often there is not), it is probably more efficient (and definitely more scalable) to do: YourSearch | stats range(_time) as sessiondur by sessionID,Username | stats sum(sessiondur) as user_total_dur by Username instead.

gkanapathy
Splunk Employee
Splunk Employee

Minor thing I'd do is only round after taking the average: `... | stats avg(DurationInMin) as avgdur by Username | eval avgdur=round(avgdur/60,2) | rename avgdur as "Average Session Duration (Minutes)".

0 Karma

ghnwmlguy
Explorer

Thanks David, I can't beleive that have never noticed the transaction command.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...