Okta: User impersonation [splunk-okta]

`get_authentication_data` eventType IN("user.session.impersonation.initiate", "user.session.impersonation.grant", "user.session.impersonation.extend", "user.session.impersonation.end", "user.session.impersonation.revoke")
| eval dest_user='target{}.alternateId'
| table _time, host, user, action, dest_host, src_ip, src_user, signature, dest_user
| bin span=1s
| stats values(*) as * by _time, src_ip