You could define a Field Extraction (Settings -> Fields) for that sourcetype using this expression: user=(?<user>.+?)\s+src_host That'll look for "user=", capture as few chars as possible until it encounters " src_host=". Check if there are any issues around the automatically extracted partial user value. ... View more