Here is the search we are using to match the user and patient's last names.
index="clinical_applications" sourcetype=app | eval USER_NAME=split(USER_NAME,",") | eval USER_NAME_LAST=mvindex(USER_NAME,0) | eval USER_NAME_FIRST=mvindex(USER_NAME,1) | eval PATIENT_LAST_NAME=upper(PATIENT_LAST_NAME) | eval PATIENT_FIRST_NAME=upper(PATIENT_FIRST_NAME) | where PATIENT_LAST_NAME = USER_NAME_LAST | strcat PATIENT_FIRST_NAME " " PATIENT_LAST_NAME PATIENT_NAME | convert ctime(_time) as Time | rename EPIC_ENTERPRISE_MRN_ID as MRN_ID | rename METRIC_DESCRIPTION as ACTION | table Time,USER_NAME,WORKSTATION,PATIENT_NAME,MRN_ID,ENVIRONMENT,ACTION
... View more