Splunk Search

Stat user duration connection

gloudou
Engager

Hello,

I would like to know if it's possible with Splunk to know the connection time of each user by day or month for example.

Thanks.

Tags (1)
0 Karma

lguinn2
Legend

You could try this:

yoursearchere |
transaction username ip startswith="Start connection." endswith="End connection" |
stats sum(duration) as TimeOnline by username |
fieldformat TimeOnline = tostring(TimeOnline,"duration")

However, if you have a large number of users who login in one day, the transaction command may not work well. But try this and see...

lguinn2
Legend

To count the number of connections per user:

yoursearchere |
eval transactionEnd=0 |
eval transactionEnd=case(match(_raw,".*end connection 1.*"),1,
match(_raw,".*end connection 2.*"),1)
transaction username ip startswith="Start connection."
endswith=eval(transactionEnd==1) |
stats count as numberOfConnections by username

Although a month may be too long of a timespan for the transaction command... If so, you might consider using a summary index to collect the daily info (number of Connections and TimeOnline)

0 Karma

lguinn2
Legend

yoursearchere |
eval transactionEnd=0 |
eval transactionEnd=case(match(_raw,".*end connection 1.*"),1,
match(_raw,".*end connection 2.*"),1)
transaction username ip startswith="Start connection."
endswith=eval(transactionEnd==1) |
stats sum(duration) as TimeOnline by username |
fieldformat TimeOnline = tostring(TimeOnline,"duration")

That may help. The match function is case sensitive, so be exact!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...