Splunk Enterprise

Report Cisco ASA VPN user usage

jodelvalle
New Member

Hi,

Let me start by saying that I just started using Splunk and I know little about how it works. However, I have a need to report VPN usage data ASAP. I found and modified the query shown below. It works great but I need to be able to show total duration per date. Currently it is adding all the time the VPN users has spent connected to the VPN since the system started collecting data.

Is it possible for the results to show Username, date and time of when they connected and the duration?
Is it possible to have that emailed to me every week?

Thanks in advance for your help.

JD

* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username

Tags (1)
0 Karma

mparks11
Path Finder

Hi there, it depends on what your data look like, but you can add information into your stats reporting command in the "by" clause. Splunk should be calculating date_ fields that you could use, such as:

| stats sum(duration) as total_duration by Username, date_month, date_mday

You could also use the bucket/bin command to bucket time by day, which might work better to help calculate the duration by day then eval the duration calculation.

| bin _time span=1d 
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...