No show user with Backslash

[edfuenteso]

Hello,
I have the next source that is a form with inputs, but the user input have users with backslash and when i choice the user, it's not show.
How i can to do this?

Example: in the input user i have CUSTOMER\admin_moss

Accesos a BD SQL Server

<!-- Create a text box; token is "series"                         -->
<!-- label: Label for the text box                                -->
<!-- default: Default value for the form                          -->
<!-- suffix: All tokens are followed by a *                       -->
<!--         If user does not specify text, then search uses '*'  -->
<input type="dropdown" token="user" searchWhenChanged="true">
  <label>Selecciona un Usuario:</label>
  <default>*</default>
  <!-- Define the default value -->
  <choice value="*">All</choice>
  <!-- Define the choices with a populating search -->
  <populatingSearch fieldForValue="user" fieldForLabel="user" earliest="-24h" latest="now">
    <![CDATA[index=sqlserver_audit | stats count by "user"]]>
  </populatingSearch>
</input>
<input type="dropdown" token="estado" searchWhenChanged="true">
  <label>Selecciona Resultado Conexión :</label>
  <default>*</default>
  <!-- Define the default value -->
  <choice value="*">All</choice>
  <!-- Define the choices with a populating search -->
  <populatingSearch fieldForValue="estado" fieldForLabel="estado" earliest="-24h" latest="now">
    <![CDATA[index=sqlserver_audit | stats count by estado]]>
  </populatingSearch>
</input>
<input type="dropdown" token="dbname" searchWhenChanged="true">
  <label>Selecciona Nombre de la BD:</label>
  <default>*</default>
  <!-- Define the default value -->
  <choice value="*">All</choice>
  <!-- Define the choices with a populating search -->
  <populatingSearch fieldForValue="dbname" fieldForLabel="dbname" earliest="-24h" latest="now">
    <![CDATA[index=sqlserver_audit | stats count by dbname]]>
  </populatingSearch>
</input>
<!-- Add time range picker -->
<input type="time" searchWhenChanged="true">
  <default>
    <earliestTime>-25h</earliestTime>
    <latestTime>now</latestTime>
  </default>
</input>


<!-- Show results as a table -->
<table>
  <option name="showPager">true</option>
  <option name="count">20</option>
</table>

[somesoni2]

What's the panel search where $user$ token is used? Does the value in your logs has user with single backslash on ?