Useing Transaction To Track VPN Open Sessions

[hartfoml]

I am tracking open session VPN activity

VPN activity can be over long periods of time. I am traking the user activity useing the transaction command on "src and user" like this

sourcetype="vpn" | transaction src user

I know that the session ends with the msg="NWC30993: Closed connection to*"
In theory I could do something like this to find open sessions sourcetype="vpn" | transaction src user | search msg!=*NWC30993*"

This gives me different results every time I run the search and different results with different time windows.
I also noticed that sometimes if I use transaction with "src & user" and the users session is closed and then reopens the session that the new session is part of the old transaction and will not show up in the search becasue the "NWC30993" is part of the transaction.

I can do this sourcetype="vpn" | transaction src user endswith="msg=*NWC30993*" but this excludes any open transaction that do not end with the "closed connection" event.

Let me know if this makes sense

Any suggestions would be great

[lguinn2]

You should look at the Search Job Inspector and see if it has any messages that would explain what is happening with this search. Remember that the transaction command brings all the events into memory in order to compose the transactions. At least it tries - this can be problematic with large data volumes.

If all that you want is to find open sessions, you could do something like this:

sourcetype="vpn" (msg="NWC30993: Closed connection*" OR msg="Whatever is the open message")
| sort 0 _time
| stats earliest(_time) as startTime latest(_time)as endTime latest(msg) as LastMessage count list(msg) as Messages by src user
| where  not match(LastMessage,"NWC30993: Closed connection")

This should work regardless of the data volume and it should also run much faster.