User login,logout and Session Info

Try something like this:

Select *, "NEXT_TSTAMP" - "EVENT_TIMESTAMP" As "DURATION"
From (
  Select *, lead("ACTION") OVER (Partition By "ACTOR" Order By "EVENT_TIMESTAMP") As "NEXT_TSTAMP"
  From audit_events
  Where .......
) subq
Where "ACTION"='login'
Order By EVENT_TIMESTAMP

The last login, if not yet logged out, will have nulls for NEXT_TSTAMP and DURATION.

2 Likes