im doing a user name search and i want two of the fields in my results table to be the time the user started the connection and also when they disconnected the session to the network. What is this information classified as, and what field would it be called?
connect/ disconnect field....
thanks
happy splunking
blake