What search syntax to search for VPN log history of specific user?

[rhazzaguilar]

What search syntax to search for VPN log history of specific user?

[lukejadamec]

search index=yourvpnindex sourcetype=yourvpnsourcetype  "*yourspecificuser*" 

More information about what you want out of the search would be helpful.

General rules for an efficient search are to be as specific as possible with the search.

[lukejadamec]

Can you run a search in the Search App that shows the logs you're interested in?

If so, then do so. Look to the left. The source, sourcetype, and index will be listed. To find the index you might have to scroll to the bottom and select View All.
Post back what you find along with a pretend user name.

[rhazzaguilar]

if I am using Cisco Anyconnect, what will be my vpnindex and vpnsourcetype?