Splunk Search

Has Splunk got a good memory ?

Mahieu
Communicator

Hi,

I'm trying to identify the difference between two events, for instance :
Event 1 : user=jdoe message="session timed out"
Event 2 : user=jdoe message="logged in"

Problem is : i have to keep the user parameter saved somehow.

Two options would work for me, either finding out what's the time difference between these events or knowing if event 2 happens less than x minutes after event 1.

I've tried using delta and transaction but it's not working correctly ...

Thanks in advance for your help.

M

1 Solution

araitz
Splunk Employee
Splunk Employee

Here's a blog post I wrote about maintaining state with lookups:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

View solution in original post

Mahieu
Communicator

It's been a while sorry, here's all i could come up with :
sourcetype=xxx msg="primary authentication successful" OR msg="session timed out" | transaction user startswith="session timed out" endswith="primary authentication successful" maxspan=5m | search msg="session timed out"

Seems to work pretty well.
Thanks for your help.

araitz
Splunk Employee
Splunk Employee

Here's a blog post I wrote about maintaining state with lookups:

http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/

chris
Motivator

I also think that the transaction command could help you, I haven't tried the search below but the idea is to get all users that log back in into a transaction and then just search for the unclosed transactions. You should then be left with logins and session timeouts that are not related.

message="logged in" OR message="session timed out" | transaction user  maxspan=<x min> maxpause=<x min>  startswith="session timed out" endswith="logged in" keepevicted=true | search closed_txn=0

You probably just want the users in the session timed out messages.

message="logged in" OR message="session timed out" | transaction user  maxspan=<x min> maxpause=<x min>  startswith="session timed out" endswith="logged in" keepevicted=true | search closed_txn=0 message="session timed out" | top user

Chris

Mahieu
Communicator

Any ideas here ?

Mahieu
Communicator

Hi there and thanks a lot for this answer. I've tried that but removed keepevicted=true. If i leave ' search closed_txn=0 message="session timed out" ' i've got no results. If i remove it, i've got the events i'm looking for but it seems like the maxspan is not taken into account. No matter what time value i put, it's not filtering anything.

Here's my search :

sourcetype="xxxxxx" msg="login succeeded" OR msg="Session timed out" | transaction user startswith="Session timed out" endswith="login succeeded" maxspan=5min maxpause=1min (| search closed_txn=0 msg="Session timed out")

fk319
Builder

I think transaction is the correct direction.


What I would suggest that you look for is a transaction that has a message [list] that has more than one "log in" and a "time out".

Mahieu
Communicator

Sorry for the unclear explanation. In the end, the goal is to know whether or not my users log back in (event : jdoe logged in) when their session time out (event : jdoe's session timed out). The idea is to identify the users who do not log out when they leave my application and that's not good because they leave idle sessions.

Ayn
Legend

I think you'll need to state your problem more clearly. In what way do you need to 'save' the user parameter? How are you planning to use this search? Should it be user-independent and used in a search form somehow where Splunk users can specify the value for this field?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...