Getting Data In

time start and time end

riderofyamaha
Explorer

im doing a username search and i want two fields in my results table to be the time the user sarted the connection and also when they disconnected the session to the network. What is this information classified as, and wat field would it be called?

thanks

happy splunking

blake

Tags (2)
0 Karma

riderofyamaha
Explorer

im searching sys logs, on a windows system....ive also read through the documentation text with no success so far. I want to show a connection start and end time in a form search results field

0 Karma

riderofyamaha
Explorer

???????????????

0 Karma

thall79
Communicator

The problem is there is not enough information to help you with your question. What are type of system are they connecting to? Unix, Windows...

Also have you had a chance to go through the knowledgebase?

http://www.splunk.com/base/Documentation/latest/User/HowSearchCommandsWork

http://www.splunk.com/base/Documentation/4.1.3/Knowledge/Aboutfields

http://www.splunk.com/base/Documentation/latest/User/SearchExamples

Here a few that may help.

Travis.

0 Karma

lguinn2
Legend

What sourcetype are you searching?

0 Karma

riderofyamaha
Explorer

so people will click minus one but cant answer a simple question. This site really is disappointing me

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...