I have a Cisco ACS serving radius requests for VPN users. The syslog is configured for splunk and is able to receive data and index all fields. Following are the sample log texts shown for a particular user (XXXX_user93) (only interesting fields) a) RADIUS Start record
Feb 21 10:32:34 2012-02-21 10:32:34.134 +05:30 NOTICE Radius-Accounting: RADIUS Accounting start request, NetworkDeviceName=XXXX_Roam_Connect, User-Name=XXXX_user93, Framed-IP-Address=10.32.38.93, Calling-Station-ID=18.104.22.168, NAS-Identifier= YYYY-FG-MUMENT, Acct-Status-Type=Start, Acct-Session-Id=00a2fc9c, AcsSessionID= INMAA-TDL-ACS-I/112925452/1282834,
b)Corresponding RADIUS Stop record Feb 21 10:32:41 2012-02-21 10:32:41.127 +05:30 NOTICE Radius-Accounting: RADIUS Accounting stop request, NetworkDeviceName=XXXX_Roam_Connect, User-Name=XXXX_user93, Framed-IP-Address=10.32.38.93, Calling-Station-ID=22.214.171.124, NAS-Identifier=YYYY-FG-MUMENT, Acct-Status-Type=Stop, Acct-Session-Id=00a2fc9c, Acct-Session-Time=468, Acct-Terminate-Cause=NAS Error, AcsSessionID=INMAA-TDL-ACS-I/112925452/1282838
The start and stop requests are correlated by the field Acct-Session-Id for which the value would be the same for a particular users start and stop record.
What we are looking is a daily, weekly, monthly report in a tabular format, something similar to this
NetworkDeviceName | Username | Starttime | Endtime | Acct-Session-Id | Acct-Session-Time
I have tried with no success
We are currently evaluating Splunk and would like help in achieving the above. Have searched for apps in Splunk base and couldnt find any.
Thanks in advance.
asked 20 Feb '12, 21:28
What ways have you tried without success? I can think of two ways you could achieve this fairly easily: either using
The drawback with using
2) You can use
answered 20 Feb '12, 23:37