Hi All,
**
Summary
**
I have windows logs for remote VPN access. I want to be able to graph concurrent use by user. But the problem is : example - I have one log EventCode=123 which is a remote connection that occurs at 2pm for instance and EventCode=321 which is a disconnection that occurred at 5pm. Between the fields there are no logs so timecharting comes back with a 1 on 2pm and a 1 on 5pm but 0 on the hours between...I want to have a count on the hours between to show that the session was active. Is there a way to do this?
https://answers.splunk.com/answers/811217/concurrent-active-vpn-sessions-on-a-timechart.html
This is a similar question.
I made the query. It's not easy. good luck.
but now, here is the app.
Hello, I think you should use transaction command with username and startswith and endswith options.
... | transaction user startswith="EventCode=123" endswith="EventCode=321"
After that, you can use duration
field in the result of transaction command to calculate session duration.