Splunk Search

Searching Cisco ASA sourcetype in Splunk

eholz1
Contributor

Hello All,

I would like some suggestions. I am trying to search the Cisco ASA sourcetype in Splunk for the current users that are logged in to an ASA. I am trying to use "last 24 hours" as the start time range.

I am trying to count login message (113004) and compare with logout message (722023).

There are other message ids for logout:716002, 113019. It seems that I need the "latest" login. The user can log in and log out - I can get pairs by user for a login/logout.

If there is a pair like that I can assume the user is not logged in. The challenge comes with the fact the user can have logged in and out multiple times. My theory is that if a user has more logins that logouts (assuming there is a login later than a log out). this should be a user that is logged on. The trick seems to be finding the latest log in per user, and counting values in the "message_id" field. Any suggestions here? I  can check users on the ASA using the "show vpn-session summary" command, but that number almost never matches my searches.

I can use any suggestion.

Thanks

eholz1

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One way to do that is to search for all login and logout events then throw out all except the most recent event for each user.  Then discard all logouts and what's left will be logins without matching logouts.

index=foo sourcetype=cisco:asa message IN (113004 722023 716002 113019)
| eval type = if(message=113004, "login", "logout")
| dedup user
| where type="login"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

One way to do that is to search for all login and logout events then throw out all except the most recent event for each user.  Then discard all logouts and what's left will be logins without matching logouts.

index=foo sourcetype=cisco:asa message IN (113004 722023 716002 113019)
| eval type = if(message=113004, "login", "logout")
| dedup user
| where type="login"
---
If this reply helps you, Karma would be appreciated.

eholz1
Contributor

Hello richgalloway,

 

Thanks for the reply. At least I know my "logic" is correct! Thanks for the reply, and even answers to my previous posts.  I will try your suggested search.

The community is a valuable resource.

eholz1

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...