Splunk Search

How can I track time that a user is using VPN access outside the country?

digital_alchemy
Path Finder

I have a need to track VPN access outside the country. I have an alert that triggers when someone accesses the VPN from outside the country but I would like to make another search to track the amount of time they have been outside the country based on the event time stamp.

Current search to alert on OCONUS VPN use:

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | dedup vpn_user,Country | table _time,vpn_user,Country,vpn_remote_ip

I would like to modify the above search to create a report that would show something like below:

User              OCONUS time
User1             15 days
User2              9 days
Tags (4)
0 Karma

woodcock
Esteemed Legend

We need an example of both a VPN start event and a VPN stop event.

0 Karma

sundareshr
Legend

Try this

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | stats earliest(_time) as logintime by  vpn_user | eval duration=now()-logintime |  eval Day=strftime(logintime,"%m/%d/%Y") | eval duration=tostring(duration, "duration") | rename logintime AS "OCONUS time" | table vpn_user "OCONUS time"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | eval Day=strftime(_time,"%m/%d/%Y") | stats dc(Day) as "OCONUS time" by  vpn_user
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...