Splunk Search

quick fields question. Time connected/time disconnect?

riderofyamaha
Explorer

I want my table to show a column with what time a username connected to the network and another column showing when they disconnected the network...what is the field called and the shortcut to extract this info from my data?

thanks, blake

Tags (1)
0 Karma

riderofyamaha
Explorer

goddamn i give up

0 Karma

riderofyamaha
Explorer

the sourcetype is syslog....as far as i can tell...is that what you mean? im new to the IT world, thanks for your patience and help 🙂

0 Karma

riderofyamaha
Explorer

??????? come one guys

0 Karma

riderofyamaha
Explorer

i dont know what you mean by device. Do u mean server brand? but a data example is:

Jul 12 12:48:54 foobar.net Jul 12 2010 12:25:03: %ASA-4-113019: Group = foobar, Username = Username1, IP = 10.238.96.133, Session disconnected. Session Type: IPsecOverNatT, Duration: 0h:27m:44s, Bytes xmt: 1879054, Bytes rcv: 591784, Reason: User Requested

specifics removed for security...

could someone please show me how to display a field for when a user connecting and disconnecting the network?

0 Karma

Paolo_Prigione
Builder

"syslog" is still too generic... with access to the network, which kind of device do you exactly mean? if you can provide us some data example we can help you extract the proper fields

0 Karma

lguinn2
Legend

Can you provide the sourcetype of the data you are trying to search? Otherwise, there is no way to know the name of the field. Thanks!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...