Splunk Enterprise

Report Cisco ASA VPN user usage

jodelvalle
New Member

Hi,

Let me start by saying that I just started using Splunk and I know little about how it works. However, I have a need to report VPN usage data ASAP. I found and modified the query shown below. It works great but I need to be able to show total duration per date. Currently it is adding all the time the VPN users has spent connected to the VPN since the system started collecting data.

Is it possible for the results to show Username, date and time of when they connected and the duration?
Is it possible to have that emailed to me every week?

Thanks in advance for your help.

JD

* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username

Tags (1)
0 Karma

mparks11
Path Finder

Hi there, it depends on what your data look like, but you can add information into your stats reporting command in the "by" clause. Splunk should be calculating date_ fields that you could use, such as:

| stats sum(duration) as total_duration by Username, date_month, date_mday

You could also use the bucket/bin command to bucket time by day, which might work better to help calculate the duration by day then eval the duration calculation.

| bin _time span=1d 
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...