sourcetype=vpn event_id=20194 | transaction startswith="connected" endswith="disconnected" by vpn_ip_address keepevicted=true | search closed_txn=0 | table vpn_user
You will need to create two extractions:
vpn_user
vpn_ip_address
vpn_user should capture the username
vpn_ip_address should capture the ip address the user is assigned
Hope it works for you!
... View more