https://community.splunk.com/t5/Security/select-correct-username-from-VPN-session/m-p/492440#M11273 <P>We have a use case, when user mistakenly in first attempt wrong user name, in 2nd attempt again put the wrong username, in third attempt he user the right credentials and proceed for OTP.</P> <P>attaching snapshot for better understanding. I want to collect the username following by <BR />"Following rule 'Successful' from item 'OTP Verify' to terminalout 'Successful'" message.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8534iC4A28972016B0CAB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sun, 07 Jun 2020 20:07:11 GMT riqbal47010 2020-06-07T20:07:11Z https://community.splunk.com/t5/Security/select-correct-username-from-VPN-session/m-p/492440#M11273 <P>We have a use case, when user mistakenly in first attempt wrong user name, in 2nd attempt again put the wrong username, in third attempt he user the right credentials and proceed for OTP.</P> <P>attaching snapshot for better understanding. I want to collect the username following by <BR />"Following rule 'Successful' from item 'OTP Verify' to terminalout 'Successful'" message.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8534iC4A28972016B0CAB/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sun, 07 Jun 2020 20:07:11 GMT https://community.splunk.com/t5/Security/select-correct-username-from-VPN-session/m-p/492440#M11273 riqbal47010 2020-06-07T20:07:11Z https://community.splunk.com/t5/Security/select-correct-username-from-VPN-session/m-p/492441#M11274 <P>Is there a common field or common data in all of the events you are interested in?</P> <P>Can you provide anonymized sample data instead of just wiping out sensitive information with blue? I think that additional info will be needed in order to link the event containing the "Successful" message back to an event containing the user name.</P> Tue, 17 Mar 2020 14:21:51 GMT https://community.splunk.com/t5/Security/select-correct-username-from-VPN-session/m-p/492441#M11274 rmmiller 2020-03-17T14:21:51Z https://community.splunk.com/t5/Security/select-correct-username-from-VPN-session/m-p/492442#M11275 <P>create session from login to success, and find latest username</P> Tue, 17 Mar 2020 22:03:09 GMT https://community.splunk.com/t5/Security/select-correct-username-from-VPN-session/m-p/492442#M11275 to4kawa 2020-03-17T22:03:09Z