Splunk Add-on for Cisco WSA: How to automate username formatting in Top Users panel?

[isaac_cushman]

I am having some trouble with the Cisco Security Suite addon for WSA. The "Top Users" panel I had to modify quite a bit to just get results in it. When I click on a user result it tries to search for NCMH\test.proxy@NCMH which fails to return results. If I change the username format to test.proxy I get results properly. How can I programatically automate this?

My current Top Users search string is as follows: eventtype=cisco-wsa-squid | eval action=if(http_result="TCP_DENIED/","block",action) | eval cs_username=if(isnull(cs_username) OR cs_username="-","["+c_ip+"]",cs_username) | chart count by cs_username,action | eval count=NULL+error | eval f_username=if(match(cs_username,"^["),"",cs_username) | eval f_ip=if(match(cs_username,"^["),replace(cs_username,"[[]]",""),"*") | sort - count | table cs_username,f_username,f_ip,count,NULL,error | rename cs_username as "Username",count as "# Requests", error as "Blocked", NULL as "Allowed"

Thanks in advance for any help as I am a Splunk noob.

P.S. Shame on Cisco for not having better walkthroughs i'm sure i'm not alone when it comes to the default settings not working out of the box.

[jcoates_splunk]

I'll take a stab in the dark to get this out of my filters... and guess that because this is W3C web logs which allow almost entirely freeform craziness, and we can only accept a couple of those formats, you've probably got your data coming in one that we don't do.