0

I need to make a timechart of concurrent VPN users connected to my Cisco ASA like the one in the following screenshot:

look! here is "the perfect" timechart in splunk

Another timechart screenshot here: https://drive.google.com/file/d/1dW8nyG3dz3GbPiXuiXZofuhccoHpEHSP/view?usp=sharing

In splunk it was made possible by the awesome query posted here: https://community.splunk.com/t5/Splunk-Search/Concurrent-Active-VPN-Sessions-on-a-Timechart/m-p/493141#M137524

If I have to use the same logic to achieve the desired result, I just need your help to convert the following part of the above splunk query into KQL:

| sort 0 _time
| eval time2=_time 
| bin span=20m time2
| eval time2=if(status="disconnected",NULL,time2)
| eval _time=coalesce(time2,_time)
| streamstats count(eval(status="assigned")) as session by user
| stats values(eval(if(status="assigned",round(_time),NULL))) as start  values(eval(if(status="disconnected",round(_time),NULL))) as end by user session
| eval timerange=mvrange(start,end,1200)
| mvexpand timerange
| rename timerange as _time
| timechart span=20m count(user)

Expected Output (from splunk) : https://drive.google.com/file/d/11F5p_zOGlgenIqVsToXiPlL2UplSIRNa/view?usp=sharing

Sample Data (from Sentinel, parsed) : https://drive.google.com/file/d/1wzansi1MfCnUylNHSeUHiw8POIxzS4q_/view?usp=sharing

Yea, we had to switch from splunk to Azure Sentinel. (Don't ask why.)

Prakhar
  • 1
  • 1
  • Can you add a sample data and the expected output? (copy the sample data from sentinel and the exacted output based on the Splunk query). – Avnera Dec 31 '20 at 08:10
  • @Avnera added to the original post – Prakhar Dec 31 '20 at 10:07
  • Thanks Prakhar - the Splunk query seems complex and it is hard for me to translate it without trying it out on a sample environment on both sides step by step to ensure that the results are the same. If you can describe what each step suppose to produce including a sample output after each line it would be ideal, if not, try to work through it operator by operator. Feel free to ping me offline to my Microsoft account (use my stackoverflow name with the microsoft.com address). – Avnera Jan 02 '21 at 09:29

0 Answers0