I am new to Syslog and Splunk. We are trying to be able to track users logging into the VPN Concentrator 3000. We have a syslog server setup and I just recently installed Splunk. I am looking for some guidance on how I could setup a report or dashboard to show user login history.
If not, then the first thing you'll want to do is come up with a series of searches that describe the conditions you're interested in. I'm not a VPN 3000 user (ASAs instead), so I really don't know what searches would be right for this situation.
One thing to consider is that the VPN3000 logs may not be your "best" source of data for this type of event. For example, we get much higher fidelity data from our RADIUS server's accounting logs. Our ASA sends an "start session" accounting event followed by an "end session" accounting event to our RADIUS server, and those are much easier to deal with. If you're using RADIUS, this may be a good choice. (My opinion is that it would be worth configuring a RADIUS server just for the accounting, even if you don't use it for authentication and authorization)