I have a query where I can see in a snapshot current active users per VPN profile (group). Having a hard time being able to plot number of active sessions on a timechart. The timecharts I make show me number of new connections, which is not what I am after. I am after seeing the total number of active connections per VPN profile (group) every 10 minutes for example. SPL: index=vpn_index message_id IN (113039 113019) group IN (ABC* XYZ* DEF* UVW*) | transaction Username keepevicted=true startswith="113039" endswith="113019" | eval session-status=if(closed_txn==1,"Completed","In Progress") | search message_id="113039" | fields src, _time, session-status, Username | search session-status="In Progress" | rename group as "VPN Profile" | stats count as "Active Sessions" by "VPN Profile" Any help is appreciated! - Adam
... View more