OK. I'm not sure what are your boundary conditions (for example - can the same user have multiple concurrent connections? that breaks transaction). Also the last command seems strange for me - it should count distinct usernames by... username? Makes no sense. Anyway, if the users cannot have multiple overlapping connections, I'd go a completely different way. 1. There is a built-in command "concurrency". (even if there wasn't there's a way to count concurrent connections with streamstats. 2. For a non-concurrent connections per user it's probably easiest to do something like that (don't have my Splunk available at the moment so it's a "dry run" code). index=myindex event IN (login,logout) ``` That's obvious ``` | eval login_time=if(event=="login",_time,null()) | eval logout_time=if(event=="logout",_time,null()) ```we create two artificial fields we'll soon use``` | streamstats current=f last(logout_time) as logout_time by username ```we copy the logout time to the login event; remember that events are returned in reverse chronological order so we have logouts first``` | search event="login" ```we don't need logouts anymore | eval duration=logout_time-login_time ```well, we could have skipped creating logout_time since it's equal to _time anyway but this way it's more verbose``` | concurrency duration=duration start=login_time That's a rough idea of how to approach this problem - carry over the logout time to the login event and then do your calculations. You could also emulate the concurrency command differently - using additional field to carrying -1 for login and 1 for logout (if going through the events in default order) and do streamstats sum on those values.
... View more
