I'm looking to create a timechart of VPN sessions that shows the number of users logged on over the course of a 24 hour period. The problem is I want the count to stay up until the logoff/timeout event occurs for that user. I can easily create the list of users that are currently logged on and I'm using that as my starting point. NOTE: I've created the event type of "vpn_session_event" which looks at level 6 events in the Cisco ASA.
eventtype=vpn_session_event | transaction fields="user" maxspan=12h30m connected=f startswith="*connection established*" | search eventtype!=cisco_vpn_end | dedup user
This will produce the list of current users, Now I need to chart this over time to get a count of how many user sessions were started over the course of the day dropping the number when the disconnect event occurs to show peak usage. Anyone have a technique for this?
You need the concurrency
command:
http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Concurrency
Also, ditch the transaction
command first:
http://wiki.splunk.com/Virtual_.conf#March_2016
We do something similar with our firewalls, tracking the number of sessions that are active. Adding timechart count(connect_id) for us charts the number of action connections over a given period of time and shows the peak during the day.
eventtype=vpn_session_event
| transaction fields="user" maxspan=12h30m connected=f startswith="*connection established*"
| search eventtype!=cisco_vpn_end
| dedup user
| **timechart count(user)**