Hoping I'm giving you the advice you are looking for.
Might be wrong but I think this is what you are looking for:
In reports go to Resource config- User Authorization Audit and click Run; put w/e times you think will grab the sample data you want (you might get more info than you want at first)
Next go to Select Expert.
Select DetectionIP
Select "is equal to" and put the detection IP address you see for the logs you want to capture from the sample log generated.
If you want to put more than one IP click new again (I'm guessing, haven't had to use it yet; just started using LEM too)
Kick Ok and your filtered log of what you want should generate.
So you won't have to do this every time: Go to Export, format: crystal reports (rpt) destination disk file
Save the file in your program files, in the solarwinds lem directory, in the folder name custom reports.
Now when ever you want to build a report for your vpn you can go to custom reports, select the range and done~
Just do me a favor, if this works just try to check thwack and help out the next newbie~
~spread the love and knowledge~
Hope this helped