It can be found in sysevent table. Please try searching with (sourcetype="snow:sysevent" name=login) in Splunk search. It will give the events of login success for a particular ServiceNow instance which will have username details as well.
... View more
It can be found in sysevent table with 'name=login' included in the search query which will give the login success events for a particular ServiceNow instance.
... View more