Building for the Splunk Platform

Translating a defined tracking session using SPL

dwong2
New Member

How would I do this in SPL?

I want to calculate a tracking session:
Find an ENTER event in the log.
Search forward in the log data for events after this event with the same device ID and same account ID. Sort them by date (ascending).

Walk through the log events in order, adding them to the session. If any of the following occurs, we stop searching:

If the next is more than "session timeout" (default 5 minutes) after the previous event in the session, consider the session terminated.

If an EXIT or TIMEOUT event occurs, consider the session terminated.

Find the last non-timeout event.
Session duration calculation is based on the time difference between the first event and the last non-timeout event.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...