This is provided by DavidM of Austin, TX. He proactively monitors his Sumo user to see if they are timed out frequently because the default session time-out value. He came up with this query so he gets a list of those user, whom might be annoyed due to session timed out. _index=sumologic_audit _sourceName=SESSION // // How to adjust web session timeout value: https://help.sumologic.com/Start_Here/Quick_Start_Tutorial/02_Set_Your_Account_Preferences | join ( parse "User * " as userid | where _raw matches "*successfully logged in*" | last(_messagetime) as logontime by userid ) as t1, ( parse "User * " as userid | where _raw matches "*was timed out of their account*" | last(_messagetime) as timeouttime by userid ) as t2 on t1.userid = t2.userid | t1_userid as userid | t2_timeouttime - t1_logontime as sessiontime | sessiontime/1000/60 as minutes | round(minutes) | where minutes > 0 and minutes < 360 | count userid, minutes | fields userid, minutes
Please sign in to leave a comment.