Splunk Search

Get login duration from WinEventLogs

Cstone1
Engager

I've got tons and tons of logs.

What I want is login durations from the wineventlogs by usernames. Each event has the EventID and the username that caused it.

Lets say the username is "jbob"

So EventID=4624 is a login

EventID=4634 (disconnect/timeout) OR EventID=4647 (actual logoff).

How can I get the time from login id to one of the two logoff ids. For each login throughout the search window? They could log in and out 50 times in a day for example.

 

Labels (2)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

There could be multiple logons and multiple logoffs for a single session but user may not aware of this (you could test this just by login and logoff in a minute). I am not sure why windows event logging is creating many.

Logon_ID is unique ID to track starting and ending of session.

The simplest way to identify duration between logon and logoff using Logon_ID would be something like below:

index=windows EventCode IN (4624,4634,4647) 
| stats earliest(_time) as earliestTime latest(_time) as latestTime range(_time) as duration by user,host,Logon_ID
| search user!=*$
| convert ctime("*Time") timeformat="%d/%m/%Y %T"

 

 

 

 

————————————
If this helps, give a like below.

View solution in original post

0 Karma

thambisetty
SplunkTrust
SplunkTrust

There could be multiple logons and multiple logoffs for a single session but user may not aware of this (you could test this just by login and logoff in a minute). I am not sure why windows event logging is creating many.

Logon_ID is unique ID to track starting and ending of session.

The simplest way to identify duration between logon and logoff using Logon_ID would be something like below:

index=windows EventCode IN (4624,4634,4647) 
| stats earliest(_time) as earliestTime latest(_time) as latestTime range(_time) as duration by user,host,Logon_ID
| search user!=*$
| convert ctime("*Time") timeformat="%d/%m/%Y %T"

 

 

 

 

————————————
If this helps, give a like below.
0 Karma

Cstone1
Engager

Thanks. 

 

I tried this is some slight mods and it appears to give me results. It's going to take some effort to verify the results and I'm not sure how its handling multiple logins at the moment. But for now its got me in the right direction.

 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...