Report on how log a user was logged on?

[neiowe]

I am trying to generate a report that show how long users stayed logged on. I can do a search and find the users and event codes I am interested in but is there a way of comparing event times and generating a timeframe between events? In other words, is the a way to subtract the time that event code 4624 happened from event code 4634 for Account_Name=XXXX?

Using Splunk 6.3 on Lynx getting events from Wineventlog_security.

[somesoni2]

Try something like this

index=YourIndex source="WinEventLog:Security" EventCode=4624 OR EventCode=4634 | transaction Account_Name startswith=EventCode=4624 endswith=EventCode=4634  maxevents=2 | table _time Account_Name duration