I can only speak for myself: I never got this work satisfactorily 100% of the time. Not only did logoff times sometimes report incorrectly (as the same as logon), but also different people's logins would often overlap and mess up the calculations. In the end, I think we went with another solution besides splunk (I'm not certain because the project was handed off to someone else). ... View more

thank you so much. out of curiosity, is there any method to making it apply retroactively? ... View more

These both work perfectly after your corrections, as far as I can tell on my test machine. Now I'm off to test them in the real world situation (checking them against the existing paper logs). Thank you very much!!! ... View more

Thanks for your reply. The purpose of the report is: there is a workstation which multiple users share and the department wishes to bill back use of the equipment to each user according to the number of hours they were logged in. This is currently done on a paper sign-in sheet, but they wish to automate the process. I agree with you that timechart may not be the best way to do this and also that I probably should be matching event codes to specific logon/logoff events. I've attempted other ways, but I've been having trouble getting them to work properly and the code I posted is the most workable and accurate I've come up with so far. I've tried your examples and the results from the first one look the closest to what I'm going for, but for some reason the Account_Name column is empty. I'm going to tinker with it on my end and see if I can get it working better. ... View more

Thanks. Changing this has filled in the "Logofftime" column, but the logon and logoff times are the same. I think this is because duration still equals zero. Getting closer... ... View more

To be specific, I am needing to tracking logon/logoff times for a specific workstation. I've installed the Splunk forwarder and configured it to forward the Security log to our index. Here is the code I am using: index=MyIndex host="MyMachineName" sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=4634 Account_Name=* | eval User=if(mvcount(Account_Name)>1, mvindex(Account_Name,1), mvindex(Account_Name, 0)) | eval User=lower(User)| search NOT (User=*$ OR User=system) | transaction User maxevents=2 startswith="EventCode=4624" endswith="EventCode=4634" maxspan=-1 | eval Logofftime=Logontime+duration | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as Logontime | convert timeformat="%m/%d/%y %H:%M:%S" ctime(Logofftime) as Logofftime | eval Duration=round((duration/60), 0) | table Logontime, Logofftime, and Duration User host | sort User host And as a result, I'm getting a table which has: Logontime column with a series of logon times Logofftime column which is always blank Duration column which is filled with zeros User column which has a list of users (one for each logontime) host column which has the machine name repeated (this is here because eventually I want to monitor five machines total) it seems so close... if I could just get it to fill in the logoff and duration columns, my boss would be so happy. But I can't seem to figure it out any further than this... can anyone provide assistance? Thanks. ... View more

I too cannot get this to work for me. It creates a table with the users and Logontimes, but the Logofftime is always blank and duration always equals zero. I've been tinkering with it all day but cannot get it to fully work. It seems so close though! I feel like the way it is defining duration and Logofftime is cyclical and self-referential... ... View more