Splunk Search

Looking for a search that will provide the duration of time a VPN user was seen online

bluemarvel
Path Finder

The search should provide the time period in which the user was logged through VPN and possibly when the IP lease is up.

0 Karma

anthonymelita
Contributor

Take a look at the transaction command. You select one or more fields to key on and your search merges the matching events into a single transaction and auto-calculates duration. There are a handful of optional arguments for tuning as well to do stuff like limit or capture gaps in events.
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

0 Karma

niketn
Legend

@bluemarvel, community members will be able to assist you with your query if you provide more details of what your VPN data looks like in case user logs in or logs out (this should include timestamp, unique ID for logged in user and field indicating Login and Logout).

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nickhills
Ultra Champion

Can yougive us some sample logs, or at least a clue as to what the vpn solution is?

If my comment helps, please give it a thumbs up!
0 Karma

bluemarvel
Path Finder

below is the query

index=enterprise sourcetype="callzone:vpn" source="/var/log/vpn.log" "virtual IP" | streamstats current=f global=f window=1 last(_time) as last_ts | eval time_since_last = _time - last_ts | fieldformat time_since_last = tostring(time_since_last, "duration")

I would like to gage the duration of how long the user-VPN IP was online , this query is not working to the extent i would like

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...