How can i extract just the usernames from the log event message. I used the parse function , but it still doesn't display the usernames

Question

This is one of the log event message

2023:12:05-09:54:47 streamname aua[12826]: id="1234" severity="warn" sys="System" sub="auth" name="Authentication failed" scrip="0.0.0.0" host="" user="Ted" caller="openvpn" reason="DENIED"

This is the query I have been using :

filter @message like /failed/ |parse @message /(?<@user>user="([^"]+)")/ |stats(distinct(@user)) AS usernames