Sure, this can be done. Use the rex command followed by a regular expression to extract the fields you need. Try this:
your search or * | rex "(opened\sfor\suser\s|password\sfor\s)(?<User>[^\s]+)" | rex "logname=(?<Logname>[^\s])"
You can see what all is extracted by appending this at the end of the above search: | stats values User Logname. I don't know if it will cover all of your cases for extracting User, but it should work for the ones provided in the question. Another way to get your Logname extraction is to use automatic field extraction since it is in field=value format, but that won't work with your User extraction.
Also, here is a great place to get started learning regular expressions: http://www.regular-expressions.info
I use this website to test my regexes: http://rubular.com/
... View more
