Using Splunk to identify SSO users that use NTLM

[itsmevic]

Does anyone have some SPL they could share that identifies SSO users that use NTLM to authenticate? Any help with this is greatly appreciated.

[itsmevic · Accepted solution]

Was able to figure this out by pulling a consistent text string produced in the SSO logs and then filtering my SPL around that.