I would like to know which user caused an event, e.g. which user got the message "out of session cals".This is a table out of the Governance Dashboard:
If I would have the user, I could select it to see all Messages caused by this user. I can get to know how often this would happen and if I may change the license type for this user.
I see. So this is specific to which users were denied access due to insufficient CALs.
It looks like the way you've set it is working.
If you wanted more ability to use that "Event Log User", you could create a list box with your expression:
Or you could add one that shows user denied:
=IF(index(Message,'No CAL assigned to user')>1,