Hi - We want to get users connected in 1 hour. When a user connects we get event_id="globalprotectgateway-auth-succ" in logs and when they disconnect then event_id is event_id="globalprotectgateway-logout-succ" . Each login in and logout should be counted as 1 event per hour but sometimes user just remains logged in and there is no logout even in that case we want the user to be counted as logged in user since they haven't logged out.
(index=firewall OR index=cloud_firewall) eventtype="pan_system" log_subtype="globalprotect" sourcetype="pan:system" ( event_id="globalprotectgateway-auth-succ" OR event_id="globalprotectgateway-logout-succ" OR "globalprotectportal-gencookie-succ") | eval logins = strftime(_time,"%H") | transaction user startswith="globalprotectgateway-auth-succ" endswith= "globalprotectgateway-logout-succ" | stats values(user), distinct_count(user) by logins
This works fine with login and logout for every 60 mins but if there is a user session that has not logged out then that user doesnt get counted in hourly user count.
