Security

Identify User Logged Out From Inactivity

swsouth
New Member

Hi all, we are looking at Splunk as a potential source to identify users that have long periods of inactivity. If there is no formal "logged out" or "timed out" message to queue on in the logs, would there be some way to determine time between last activity and then after a specified period of inactivity, the user is considered "logged out by inactivity" and added to a report that will be sent daily? Is this within Splunk's capabilities? If so, would this require any special scripting beyond a complex search?

I know this is pretty vague and I don't have a lot of specifics yet, but just wanted to throw it out and get some initial feedback. I'll provide updates as things progress.

Thanks

Tags (2)
0 Karma

dwaddle
SplunkTrust
SplunkTrust

You can get close to this with some heuristics and use of the transaction command - specifically through the use of maxpause. The theory is that when a user is active, the result of that activity creates log entries. But, if they stop being active for the application's idle timeout (which you have to know), then they have in effect "logged out by inactivity".

The "logout time" can be loosely defined as "the last event + idle timeout"

So, a search something like:

sourcetype=webseal source=*/request.log 
| transaction maxpause=30m userid
| eval logout_time=_time + duration + (30 * 60)
| table userid, logout_time

would at least get you in the neighborhood.

0 Karma

swsouth
New Member

Somesoni2, this is for another application, not Splunk. Strive, the data is supposed to be provided from the WebSEAL logs (specifically, request.log). They initially identified userid, IP, log in/out time, last activity time as the required info.

0 Karma

strive
Influencer

To add to what somesoni2 has asked for, if it is some other application's data indexed in splunk and if the log files contain the minimum required information then it is possible to generate the report that you are asking for. Whether a script is required or a splunk search is sufficient depends on the data granularity present in log events.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This information is for Splunk itself (splunk web usage by users) or any other application whose data in indexed in splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...