I'm trying to track the duration of user sessions to a server. I want to know WHICH users are connecting, and for how long each session is. The problem is, with multiple users, I'm having nested transactions happen , where USER001 joins, but USER004 Leaves, and that creates an event. I want it to ONLY look at only scenarios in which the same user that Joins, Leaves. I can't seem to get it to do this. Eventcode=44 is the event code for these particular events I want to track UserXXID is a Field Extraction I've built to show each userID, as it is not a standard username that Splunk automatically understood. The two primary types of logs I'm looking for is when they've "joined" or "left" the event. Here is the command I'm using - host="XXComputer04" EventCode=44 | transaction startswith="joined" endswith="left" |eval Hours=duration/3600 |timechart count by UserXXID Sample of the log entry I'm trying to parse. LogName=Application EventCode=120 EventType=44 ComputerName=XXcomputer004 SourceName=EventXService Type=Information RecordNumber=1234427 Keywords=Classic TaskCategory=State Transition OpCode=Info Message= [0x0x]::ProcessLeave() (xxUSER002xx) left event33001 --------- I have also tried simply - |transaction USERXXID to keep unique userID's together - and while that works, it then somehow ignores ALL "left event" messages and only shows "joined" for any given user. Any help would be appreciated!
... View more
