- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: quick fields question. Time connected/time dis...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
quick fields question. Time connected/time disconnect?
I want my table to show a column with what time a username connected to the network and another column showing when they disconnected the network...what is the field called and the shortcut to extract this info from my data?
thanks, blake
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
goddamn i give up
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the sourcetype is syslog....as far as i can tell...is that what you mean? im new to the IT world, thanks for your patience and help 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
??????? come one guys
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i dont know what you mean by device. Do u mean server brand? but a data example is:
Jul 12 12:48:54 foobar.net Jul 12 2010 12:25:03: %ASA-4-113019: Group = foobar, Username = Username1, IP = 10.238.96.133, Session disconnected. Session Type: IPsecOverNatT, Duration: 0h:27m:44s, Bytes xmt: 1879054, Bytes rcv: 591784, Reason: User Requested
specifics removed for security...
could someone please show me how to display a field for when a user connecting and disconnecting the network?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"syslog" is still too generic... with access to the network, which kind of device do you exactly mean? if you can provide us some data example we can help you extract the proper fields
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you provide the sourcetype of the data you are trying to search? Otherwise, there is no way to know the name of the field. Thanks!
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
