In Splunk Add-on for Cisco ASA user is incorrectly be extracted. Instead of extracting extracting the username as the value, the value is "user". In the event below, the field user should be cassandra, but is returned as "user".
Jun 8 14:44:35 lue-wai-wei-00s : %WEI-6-000001: PIA user authentication Successful : server = 062.11.01.83 : user = cassandra
The issue is most likely a transform issue.
Splunk Add-on for Cisco ASA, version 3.2.2, build 263053