From which devices (ex: ips, firewall) can I see the ftp login logs with usernames?
Thanks in advance
You can see the logins from any device that logs the login data with usernames provided those logs are indexed by Splunk.
If you need help building a search, then you should post some sample events that contain the login data from the various devices.