How to perform splunk search for local account in the openstack tenant (and audit) logs ?

[LearningGuy]

How to perform splunk search for local account in the openstack tenant (and audit) logs ?
Thanks

[LearningGuy]

I need to extract local user account from syslog messages on unix audit.log. For example: "message": type=USER_ACCT msg=audit(some number)....      acct=...     etc etc      Thanks

[ITWhisperer]

This isn't what I asked for and isn't very useful - I do not have the benefit of seeing your data or be familiar with the log you mentioned, so in order to help you, you are going to need to help me by providing anonymised examples of the log events (preferably in a code block </> so that formatting is preserved).

[ITWhisperer]

Please share some (anonymised) sample log events which you have ingested into Splunk, preferably in a code block </> to preserve formatting and spaces.