i need to parse this field duser=DOMAIN\\User to only extract user without Domain\\
you can start with this with your actual data.
| eval duser="DOMAIN\\\\User"
| rex field=duser "(?<=\\\\)(?<user>\w+)"
Probably you need to adjust the amount of \-characters?
i tried this and worked duser=Domain\\+(?<duser>\S+)
| rex field=duser "\\\\\\\\(?<user>.*)"