Need help to understand logs having **** in user name.

You should confirm if the source device sending the data is obfuscating the username as **** in the raw payload. If you review the full payload (double-click on an event) there are tabs at the bottom of the Event Summary page with the full details.

Does the payload include a field, for example usr=***** or does the field appear to be obfuscated at the source?

• If yes, then you likely need to talk to the admin for that device to determine of obfuscation can be disabled if the username is required for correlation.
• If no, then the DSM might not be parsing the username as expected. If the issue is with an official IBM DSM for QRadar, then you should likely open a case. QRadar has a feature called Data Obfuscation and those values look like hashes (Mq42vh345no85239), not stars (****) as you described.

If you can sanitize a payload and provide an example, it might help us understand the root of the issue. If QRadar were obfuscating the value, a key symbol would appear next to it so you could use your private key to deobfuscate the contents.

This sounds to me like either you are receiving events with a sanitized payload OR there is a parsing error and **** is being substituted in or grabbed from somewhere else in the payload.

If this is an IBM Official DSM, you should log a case so we can investigate.