How to group all possible combinations with transaction

[yoshikawas]

Hi, I am quite new to splunk.
I have been working with the log like below.

2016/3/18 10:00:00 user=userA Action=Connect group=router
2016/3/18 10:01:00 user=userB Action=Connect group=router
2016/3/18 10:02:00 username=admin Action=Login group=server
2016/3/18 10:03:00 user=userC Action=Connect group=router
2016/3/18 11:00:00 user=userA Action=Disconnect group=router
2016/3/18 11:01:00 user=userB Action=Disconnect group=router
2016/3/18 11:02:00 user=userC Action=Disconnect group=router

The group named router and server is a log from different equipments, but is in a same syslog.
In our system, some user login to a router then ssh to a server, use username admin to login to a server.
I am wondering if I can see the all possible combinations by using transaction command to find out which user is a possible user to login to the server.

In this case, a possible user will be userA and userB.

I tried like
* | transaction startswith="Connect" endswith="Disconnect"
| search admin

it only shows one group.
It doesn't have to be transaction to solve this.
Thanks,

[snoobzilla]

Transaction should work, but you need to add the field(s) you want the transaction to group on to the statement.

| transaction host user startswith="Action=Connect" endswith="Action=Disconnect"

Will group on host user and start/end with connect/disconnect. Did you mean to have username=admin or user=admin in your original data?

[yoshikawas]

Thanks for your comment. I really appreciate your help!
Original data has a user=admin. Sorry, my bad.
I tried the | transaction host user startswith="Action=Connect" endswith="Action=Disconnect"
it only shows the combination of Connect and Disconnect.
I want to see which user did actually logged in to the server during the Connection.

The ideal search result is like below. Because, during the login session of userA and userB, there is a server login by using user admin.

2016/3/18 10:00:00 user=userA Action=Connect group=router
2016/3/18 10:02:00 user=admin Action=Login group=server
2016/3/18 11:00:00 user=userA Action=Disconnect group=router

2016/3/18 10:01:00 user=userB Action=Connect group=router
2016/3/18 10:02:00 user=admin Action=Login group=server
2016/3/18 11:01:00 user=userB Action=Disconnect group=router

Thanks, a lot.