Hi Nithin - I see that you reposted your write up from your other response to this thread. Do you actually have access to the documents from this link https://community.emc.com/docs/DOC-36270 ? Both documents are listed as private and my attempts to get these files from EMC have been unsuccessful. Without these documents or a more detailed description of this integration, the original question is still not being addressed fully. Best, Josh ... View more

This question was answered previously here http://answers.splunk.com/answers/134134/integrate-with-rsa-archer.html Hope that helps. ... View more

If you're interested in looking up who is logged in, you could use the following search "index=_internal sourcetype="splunk_web_access" user!="-" |transaction user | where mvcount(clientip) > 1 | table user clientip" to determine how many sessions are logged in with a single account. Depending on your enterprise setup, you could also do a lookup by IP to determine who is logged in from which workstation. ... View more