How can I track time that a user is using VPN access outside the country?

[digital_alchemy]

I have a need to track VPN access outside the country. I have an alert that triggers when someone accesses the VPN from outside the country but I would like to make another search to track the amount of time they have been outside the country based on the event time stamp.

Current search to alert on OCONUS VPN use:

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | dedup vpn_user,Country | table _time,vpn_user,Country,vpn_remote_ip

I would like to modify the above search to create a report that would show something like below:

User              OCONUS time
User1             15 days
User2              9 days

[woodcock]

We need an example of both a VPN start event and a VPN stop event.

[sundareshr]

Try this

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | stats earliest(_time) as logintime by  vpn_user | eval duration=now()-logintime |  eval Day=strftime(logintime,"%m/%d/%Y") | eval duration=tostring(duration, "duration") | rename logintime AS "OCONUS time" | table vpn_user "OCONUS time"

[somesoni2]

Try this

<My search>  | iplocation vpn_remote_ip | search Country!="United States" | eval Day=strftime(_time,"%m/%d/%Y") | stats dc(Day) as "OCONUS time" by  vpn_user