Hi all,
i'm trying to record all RD session on my server, i've write this query:
index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd | eval duration = (duration* 1000) |table "_time" "host" "username" "EventType" duration
It works but I need to separate every session by host, in other words transaction must be evaluated only if the host value of the start event is the same of the end event.
thanks
Try this
index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction host Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd | eval duration = (duration* 1000) |table "_time" "host" "username" "EventType" duration
Try adding host
field into your transaction command.