Splunk Search

How to find concurrent VPN users per hour?

jwalzerpitt
Influencer

We are using pulse secure as our VPN solution and I'm looking to build a search that tracks concurrent users per hour. Using my account as a test, I see the first event starts with, "Primary authentication successful for*" and ends with "Closed connection*" so based on that I created the following search:

index=foo 
| transaction startswith="Primary authentication successful for*" endswith="Closed connection*"
| eval count=1 
| timechart per_hour(eval(count)) as "Concurrent Users"

Is this a valid search for concurrent users?

Thx

0 Karma
1 Solution

cnmccown
Explorer

So I actually found a pretty simple solution for this.
You can enable "Event" logs from the VPN appliance to by syslogged (or Universal Forwarded) to your Splunk instance. Part of the Event logs are that every hour on the hour, it will generate a log entry for number of concurrent users and number of NCP connections. Now, I can just look for the log entry every hour and plot the concurrent users. The Pulse Secure App for Splunk automatically field extracted this information for me.

Very simple query for a line chart:
index=XXX concurrent_users="*" | table _time, concurrent_users

View solution in original post

cnmccown
Explorer

So I actually found a pretty simple solution for this.
You can enable "Event" logs from the VPN appliance to by syslogged (or Universal Forwarded) to your Splunk instance. Part of the Event logs are that every hour on the hour, it will generate a log entry for number of concurrent users and number of NCP connections. Now, I can just look for the log entry every hour and plot the concurrent users. The Pulse Secure App for Splunk automatically field extracted this information for me.

Very simple query for a line chart:
index=XXX concurrent_users="*" | table _time, concurrent_users

jwalzerpitt
Influencer

Awesome - thx so much!

0 Karma

jwalzerpitt
Influencer

@cnmccown - I did not as I get lower numbers as well

0 Karma

cnmccown
Explorer

Alright - thanks for the response. I'll let you know if I get a query worked out.

0 Karma

jwalzerpitt
Influencer

Would greatly appreciate it.

0 Karma

cnmccown
Explorer

Did you get a good query working for your Pulse Secure VPN? I'm working on this as well. Everything I try gives me lower numbers than what the appliance shows in the concurrent users.

0 Karma

jpolvino
Builder

One solution is to use the concurrency command. You'll need to calculate your duration.

(your search)
| eval duration=(VPN session duration in minutes)
| eval new_start = _time - duration
| concurrency start=new_start duration=duration output=overlap
| timechart span=1h max(overlap)

You can change your timechart span to fit your need.

Here is the concurrency man page: https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Concurrency

jwalzerpitt
Influencer

Thx for the reply and info. The transaction command automatically created the duration field with values so I tried the following search:

index=foo 
| transaction startswith="Primary authentication successful for*" endswith="Closed connection*" 
| eval new_start = _time - duration 
| concurrency start=new_start duration=duration output=overlap 
| timechart span=1h max(overlap)

but the number of concurrent users is too low and not lining up

Thx

0 Karma

jpolvino
Builder

The transaction command is not good for large volumes, and I have had issues with it. Some people will recommend using the stats command like this, assuming you have a unique identifier to group by:

(your search here)
| eval StartTime=if(match(_raw, "start_pattern"), _time, null())
| eval EndTime=if(match(_raw, "end_pattern"), _time, null())
| stats earliest(StartTime) as StartTime latest(EndTime) as EndTime by vpnID
| eval elapsed=EndTime-StartTime

At this point, you should be able to get a nice tabular view that can help with verifying your data, prior to moving on with concurrency.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...