select correct username from VPN session

[riqbal47010]

We have a use case, when user mistakenly in first attempt wrong user name, in 2nd attempt again put the wrong username, in third attempt he user the right credentials and proceed for OTP.

attaching snapshot for better understanding. I want to collect the username following by
"Following rule 'Successful' from item 'OTP Verify' to terminalout 'Successful'" message.

[to4kawa]

create session from login to success, and find latest username

[rmmiller]

Is there a common field or common data in all of the events you are interested in?

Can you provide anonymized sample data instead of just wiping out sensitive information with blue? I think that additional info will be needed in order to link the event containing the "Successful" message back to an event containing the user name.