All Apps and Add-ons

Logon/Logoff Tracking

Paladium
New Member

When performing user monitoring on behalf of HR or when requested by a supervisor (or performing forensics/investigations), we need a way to capture the first logon date/time and final logoff date/time each day. I have taken a number of samples from these forums and came up with this:

index=main sourcetype="WinEventLog:Security" "[insert userid]" | eval time=strftime(_time, "%m/%d/%y %H:%M:%S") | timechart span=1d earliest(time) as "Logon Time", latest(time) as "Logoff Time"

Unfortunately, the results start out fine but start to get way out of whack the closer to the current date you get. I have looked at the actual dates and times in the Events tab and the correct data is there, its just not displaying correctly. Here is an example of the output from the Statistics tab:

_time Logon Time Logoff Time
2014-05-24 05/24/14 15:00:37 05/24/14 15:00:37 <---bad
2014-05-25
2014-05-26
2014-05-27 05/27/14 09:14:06 05/27/14 17:12:41 <---good
2014-05-28 05/28/14 08:56:25 05/28/14 17:13:43 <---good
2014-05-29 05/29/14 09:02:37 05/29/14 17:06:44 <---good
2014-05-30 05/30/14 17:50:01 05/30/14 18:09:37 <---good
2014-05-31 05/31/14 11:44:14 05/31/14 11:57:16 <---good
2014-06-01
2014-06-02 06/02/14 17:47:17 06/02/14 18:11:13 <---good
2014-06-03 06/03/14 17:16:28 06/03/14 17:19:28 <---good
2014-06-04 06/04/14 17:02:42 06/04/14 17:12:14 <---good
2014-06-05 06/05/14 23:48:24 06/05/14 16:22:54 <---Starts getting weird right here
2014-06-06 06/06/14 23:50:00 06/06/14 23:50:00 <---bad
2014-06-07 06/07/14 13:05:48 06/07/14 13:05:48 <---bad
2014-06-08
2014-06-09
2014-06-10 06/10/14 22:44:30 06/10/14 22:44:30 <---bad
2014-06-11 06/11/14 16:18:01 06/11/14 16:18:01 <---bad
2014-06-12 06/12/14 16:55:23 06/12/14 16:55:23 <---bad
2014-06-13 06/13/14 18:08:19 06/13/14 18:08:19 <---bad
2014-06-14 06/14/14 13:06:34 06/14/14 13:06:34 <---bad
2014-06-15
2014-06-16 06/16/14 18:10:46 06/16/14 18:10:46 <---bad
2014-06-17 06/17/14 22:35:53 06/17/14 22:35:53 <---bad
2014-06-18 06/18/14 11:54:01 06/18/14 22:51:43 <---may be OK

Anyone have any ideas on getting the this to properly display the data?

Tags (2)
0 Karma

steveo69
Explorer

The Logfiller app also calculates and displays accurate Logon delay times...

0 Karma

ppablo
Retired

Logfiller App for Splunk page: http://apps.splunk.com/app/1800/

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=main sourcetype="WinEventLog:Security" "[insert userid]"  | eval time=_time| timechart span=1d min(time) as "Logon Time", max(time) as "Logoff Time" | convert  timeformat="%m/%d/%y %H:%M:%S" ctime(*)
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...