Hi,
Let me start by saying that I just started using Splunk and I know little about how it works. However, I have a need to report VPN usage data ASAP. I found and modified the query shown below. It works great but I need to be able to show total duration per date. Currently it is adding all the time the VPN users has spent connected to the VPN since the system started collecting data.
Is it possible for the results to show Username, date and time of when they connected and the duration?
Is it possible to have that emailed to me every week?
Thanks in advance for your help.
JD
* | rex field=duration "((?<duration_hour>\d+)h:)?(?<duration_minute>\d+)m:(?<duration_second>\d+)s" | eval duration=duration_second+60*duration_minute+3600*coalesce(duration_hour,0) | stats sum(duration) as total_duration by Username
... View more