We have utilized the DB connect for a different CMDB vendor and it works well. Looking at Splunk base, there are a couple apps that integrate the Remedy functions of BMC, however I'm not sure that includes CMDB attributes as well. Looking at the BCM documentation, there appears to be a well-documented API REST library for the CMDB that could be utilized, and you could create an integration app utilizing those API's. ... View more

index=* host=* sourcetype="WinEventLog:Security" EventCode="4624" OR EventCode=4634 | transaction user maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 | eval Logontime=if(EventCode="4624",_time,null()) | eval Logofftime=Logontime+duration | convert ctime(Logontime) as Logontime | convert ctime(Logofftime) as Logofftime | bucket _time span=day | stats sum(duration) by _time user host | rename duration AS "Duration (seconds)" ... View more

I made a slight change for readability on my part. Does any part of the query work? ... View more

Here is what I did to get it to work properly index=* host=* sourcetype="WinEventLog:Security" EventCode="4624" OR EventCode=4634 | transaction user maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 | eval Logontime=if(EventCode="4624",_time,null()) | eval Logofftime=Logontime+duration | convert ctime(Logontime) as Logontime | convert ctime(Logofftime) as Logofftime | table host, user, Logontime, Logofftime, duration | sort user, host, -duration | rename duration AS "Duration (seconds)" ... View more