Splunk Search

Looking for a search that will provide the duration of time a VPN user was seen online

Path Finder

The search should provide the time period in which the user was logged through VPN and possibly when the IP lease is up.

0 Karma

Communicator

Take a look at the transaction command. You select one or more fields to key on and your search merges the matching events into a single transaction and auto-calculates duration. There are a handful of optional arguments for tuning as well to do stuff like limit or capture gaps in events.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

0 Karma

SplunkTrust
SplunkTrust

@bluemarvel, community members will be able to assist you with your query if you provide more details of what your VPN data looks like in case user logs in or logs out (this should include timestamp, unique ID for logged in user and field indicating Login and Logout).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Ultra Champion

Can yougive us some sample logs, or at least a clue as to what the vpn solution is?

0 Karma

Path Finder

below is the query

index=enterprise sourcetype="callzone:vpn" source="/var/log/vpn.log" "virtual IP" | streamstats current=f global=f window=1 last(time) as lastts | eval timesincelast = time - lastts | fieldformat timesincelast = tostring(timesincelast, "duration")

I would like to gage the duration of how long the user-VPN IP was online , this query is not working to the extent i would like

0 Karma