Searching Cisco ASA sourcetype in Splunk

[eholz1]

Hello All,

I would like some suggestions. I am trying to search the Cisco ASA sourcetype in Splunk for the current users that are logged in to an ASA. I am trying to use "last 24 hours" as the start time range.

I am trying to count login message (113004) and compare with logout message (722023).

There are other message ids for logout:716002, 113019. It seems that I need the "latest" login. The user can log in and log out - I can get pairs by user for a login/logout.

If there is a pair like that I can assume the user is not logged in. The challenge comes with the fact the user can have logged in and out multiple times. My theory is that if a user has more logins that logouts (assuming there is a login later than a log out). this should be a user that is logged on. The trick seems to be finding the latest log in per user, and counting values in the "message_id" field. Any suggestions here? I  can check users on the ASA using the "show vpn-session summary" command, but that number almost never matches my searches.

I can use any suggestion.

Thanks

eholz1

[richgalloway · Accepted solution]

One way to do that is to search for all login and logout events then throw out all except the most recent event for each user.  Then discard all logouts and what's left will be logins without matching logouts.

index=foo sourcetype=cisco:asa message IN (113004 722023 716002 113019)
| eval type = if(message=113004, "login", "logout")
| dedup user
| where type="login"

[eholz1]

Hello richgalloway,

Thanks for the reply. At least I know my "logic" is correct! Thanks for the reply, and even answers to my previous posts.  I will try your suggested search.

The community is a valuable resource.

eholz1