Splunk Search

active user session at any given time

lain179
Communicator

Hi,

I would like to draw a chart representing number of active sessions at any given time...probably on a time chart.

The log contains three different type of log lines: Login, Log out and Expire sessions. I have come up with the following search so far, but it's not working well.


sourcetype="Engine" Server="ABC" login OR "log out" OR "removing session" | transaction UserSession | where duration=0 | timechart span=1m count(LoginDate) as in count(LogoutDate) as out count(LoginExpireDate) as expire | streamstats sum(in) as totalin sum(out) as totalout sum(expire) as totalexpire | eval totalactive=totalin-totalout-totalexpire 

Thanks.

Tags (2)
0 Karma

takeda
Engager

Hi,

Why do you filter the result of transaction command with duration=0?
I think that causes Splunk to return sessions that immediately end after they start.

Maybe "concurrency" command can be used for your purpose.
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Concurrency

0 Karma

lain179
Communicator

Not true. If there is a duration, that mean the session has already started and ended and I don't need to count them because they are NOT active. Duration is measured in millisecond, so for any completed sessions, duration will be at least 1.

By filtering for duration = 0, I get three things:
- Login sessions that has not logout or expires yet
- logout session that has a login before the time range specified
- expired session that has a login before the time range specified

And no, concurrency is not what I need.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...