Extending Search - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 138

This search gives us a list of our users such as mary , linda , Bobby , jacky , bob ,
and extrauser :
Let's say that in our group, linda and jacky are administrators. Using a standard
search, we can simply search for these two users like this:
sourcetype="impl_splunk_gen" (user=linda OR user=jacky)
Searching for these two users while going forward will still work, but instead if we
search for the tag value, we can avoid being forced to update multiple saved queries
in the future.
To create a tag, first we need to locate the field.
If the user field isn't already visible, click on it in the field picker, and then click on
Select and show in results :