splunk --filtering and corelation

[ritikaviavi]

We are having NPS auth logs from our VPN service.
Requirement : In NPS logs first when auth request come in it gets logged under Packet_Type=1 and upon rejection of auth request it gest logged with Packet_Type=3 , client IP do only come & get marked under field calling_station_id with Packet_Type=1, username gets marked under both packet_type (1 & 3) , I need to filter out events having either packet_type =1 and packet_type=3 but same username and extract field calling_station_Id, after that to further find if same set of event happening for different username from same calling_station_id.
example log:
Packet_Type=1 for username ABC123
2016-03-28T07:30:47.960 id=5296293 Computer_Name=XXXX Packet_Type=1 User_Name=ABC123 F_Q_User_Name="ABC123" Called_Station_Id=1.1.1.1 Calling_Station_Id=1.2.3.4 Callback_Number=
Framed_IP_Address= NAS_Identifier= NAS_IP_Address=5.6.7.8 NAS_Port=74940416 Client_Vendor=9 Client_IP_Address=5.6.7.8 Client_Friendly_Name=corp Event_Timestamp=
Port_Limit= NAS_Port_Type=5 Connect_Info= Framed_Protocol=

Packet_type=3 for same username ABC123
2016-03-28T07:30:47.967 id=5296294 Computer_Name=xxxx Packet_Type=3 User_Name= F_Q_User_Name="ABC123" Called_Station_Id= Calling_Station_Id=
Callback_Number= Framed_IP_Address= NAS_Identifier= NAS_IP_Address= NAS_Port= Client_Vendor=9 Client_IP_Address=5.6.7.8 Client_Friendly_Name=corp
Event_Timestamp= Port_Limit= NAS_Port_Type= Connect_Info= Framed_Protocol= Service_Type= Authentication_Type=4 NP_Policy_Name=
Reason_Code=16 Class="311 1 5.4.3.1 07/24/2016 20:10:56 138735" Session_Timeout=
Service_Type= Authentication_Type=4 NP_Policy_Name= Reason_Code=0 Class="311 1 5.4.3.2 07/24/2016 20:10:56 138735"

[somesoni2 · Accepted solution]

Give this a try (username is already extracted as field)

your base search to select both Packet_type=1 and Packet_type=3 logs
| stats values(Calling_station_id) as Calling_station_id dc(Packet_type) as Packet_types by username
| where isnotnull(Calling_station_id) AND Packet_types =2
| stats values(username) as usernames by Calling_station_id
| where mvcount(usernames)>1

This will give list of Calling_station_id where both Packet_type=1 and Packet_type=3 events happened from multiple users.