Splunk Search

Useing Transaction To Track VPN Open Sessions

hartfoml
Motivator

I am tracking open session VPN activity

VPN activity can be over long periods of time. I am traking the user activity useing the transaction command on "src and user" like this

sourcetype="vpn" | transaction src user

I know that the session ends with the msg="NWC30993: Closed connection to*"
In theory I could do something like this to find open sessions sourcetype="vpn" | transaction src user | search msg!=*NWC30993*"

This gives me different results every time I run the search and different results with different time windows.
I also noticed that sometimes if I use transaction with "src & user" and the users session is closed and then reopens the session that the new session is part of the old transaction and will not show up in the search becasue the "NWC30993" is part of the transaction.

I can do this sourcetype="vpn" | transaction src user endswith="msg=*NWC30993*" but this excludes any open transaction that do not end with the "closed connection" event.

Let me know if this makes sense

Any suggestions would be great

Tags (2)
0 Karma

lguinn2
Legend

You should look at the Search Job Inspector and see if it has any messages that would explain what is happening with this search. Remember that the transaction command brings all the events into memory in order to compose the transactions. At least it tries - this can be problematic with large data volumes.

If all that you want is to find open sessions, you could do something like this:

sourcetype="vpn" (msg="NWC30993: Closed connection*" OR msg="Whatever is the open message")
| sort 0 _time
| stats earliest(_time) as startTime latest(_time)as endTime latest(msg) as LastMessage count list(msg) as Messages by src user
| where  not match(LastMessage,"NWC30993: Closed connection")

This should work regardless of the data volume and it should also run much faster.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...