Help with calculating IIS access logs time spent on site by ip

[dondky]

Hi guys, I'm working on calculating the average time spent by a user on a internal iis site in our environment.

I came up with the following search which I think might provide us with this info:

index=iis host=exampleserver* cs_uri_stem="/care/*" | stats earliest(_time) as start latest(_time) as stop by src | eval difference=stop-start | eval start=strftime(start,"%m/%d/%Y:%H:%M:%S") | eval stop=strftime(stop,"%m/%d/%Y:%H:%M:%S") | eval difference=strftime(difference,"%m/%d/%Y:%H:%M:%S")

But I'm still unsure if this is the best approach. The goal would be to take the "difference" value and then do an average upon that to give us how long the user spent on the site. Is this the best approach or even close to what I think I'm doing?

Thanks

[dolivasoh]

You could do a transaction by the ip or a session/cookie id if you have it. Transaction will give you the duration of a group of events tied by your field of choice.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/transaction