Try this:
<populatingsearch fieldforvalue="src_user" fieldforlabel="src_user_label">
<![CDATA[sourcetype=pan_traffic earliest=-24h | stats count by src_user
| eval src_user_label = replace(src_user,"\\","\\\\") ]]>
</populatingsearch>
<chart>
...
<title>Applications</title>
<searchtemplate>sourcetype=pan_traffic src_user="$username$" host="$site$" | top application</searchtemplate>
This should give you 2 fields for the drop-down: src_user , which you can use for your search, and src_user_label . src_user_label is the same field, but is in the form <domain>\\<username> instead of <domain>\<username> You have to double up on the \ because the replace function uses regular expressions.
... View more