search index=yourvpnindex sourcetype=yourvpnsourcetype "*yourspecificuser*"
More information about what you want out of the search would be helpful.
General rules for an efficient search are to be as specific as possible with the search.
Can you run a search in the Search App that shows the logs you're interested in?
If so, then do so. Look to the left. The source, sourcetype, and index will be listed. To find the index you might have to scroll to the bottom and select View All.
Post back what you find along with a pretend user name.
if I am using Cisco Anyconnect, what will be my vpnindex and vpnsourcetype?