Security

select correct username from VPN session

riqbal47010
Path Finder

We have a use case, when user mistakenly in first attempt wrong user name, in 2nd attempt again put the wrong username, in third attempt he user the right credentials and proceed for OTP.

attaching snapshot for better understanding. I want to collect the username following by
"Following rule 'Successful' from item 'OTP Verify' to terminalout 'Successful'" message.

alt text

Labels (1)
0 Karma

to4kawa
Ultra Champion

create session from login to success, and find latest username

0 Karma

rmmiller
Contributor

Is there a common field or common data in all of the events you are interested in?

Can you provide anonymized sample data instead of just wiping out sensitive information with blue? I think that additional info will be needed in order to link the event containing the "Successful" message back to an event containing the user name.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...