Get the list of Users from the below message in a Log file

[webnair]

In the below log file: the users are JACK, ROGER

I used something like this: source="/var/log/splunk/splunkcloud/" message=*User

I need to just get the User from the below message string.

{[-]
app : "test_res",
level : 1,
message : "User JACK logged into Serv from IP address: x.xx.xxx.xx",
time : "2014-04-16T17:28:26+00:00"
}
Show as raw text
date_hour=17 Options| date_mday=16 Options| date_minute=23 Options| date_month=april Options| date_second=2 Options| date_wday=wednesday Options| date_year=2014 Options| date_zone=local Options| host=splunk Options| index=main Options| linecount=1 Options| punct={"":"","":"____:...","":,"":"--::+:"} Options| source=/var/log/splunk/splunkcloud.log Options| sourcetype=access_combined Options| splunk_server=splunk Options
2 » 4/16/14
5:23:02.000 PM

{[-]
app : "test_res",
level : 1,
message : "User ROGER logged into ownCloud from IP address: xx.xx.xxx.xx",
time : "2014-04-16T17:28:25+00:00"
}
Show as raw text
date_hour=17 Options| date_mday=16 Options| date_minute=23 Options| date_month=april Options| date_second=2 Options| date_wday=wednesday Options| date_year=2014 Options| date_zone=local Options| host=splunk Options| index=main Options| linecount=1 Options| punct={"":"","":"____:...","":,"":"--::+:"} Options| source=/var/log/splunk/splunkcloud.log Options| sourcetype=access_combined Options| splunk_server=ala-splunk

[lguinn2]

This should work

source="/var/log/splunk/splunkcloud/" message=User*
| rex "message.*?User\s(?<User>\S+)"

This should give you the a field named User.

[martin_mueller]

You could for example append a call to top:

source="/var/log/splunk/splunkcloud/" message=User* | rex "message.*?User\s(?<User>\S+)" | top User

[webnair]

Thanks lguinn for the quick response. However, I do not get the list of Users. I'm looking to get just the User (JACK, ROGER) from the above log to be displayed.
The source is ="/var/log/splunk/splunkcloud/*"It will be very valuable if you can let me know how to get just the username from the message string from the above log