Hi,
We have a Cisco ASA which is sending syslog messages to Splunk for VPN traffic. I would like to know how to create a report with the following details.
Username, duration of the VPN connection, Source IP(Public IP), Start time and End time.
Has anyone created this report already? If yes, please share the search.
Regards
Sajin
Try
... | rex field=Duration "((?\d+)h:)?(?\d+)m:(?\d+)s" | eval duration=dur_s+60*dur_m+3600*coalesce(dur_h,0) | stats sum(duration) as total_duration by Username
Can you please elaborate, how this works and what logs we need to search.