https://community.splunk.com/t5/Getting-Data-In/Why-is-there-a-carriage-return-appended-to-the-WMI-Account-Name/m-p/79894#M16436 <P>to Source Name use<BR /> | eval src_name=mvindex(Account_Name, 0)</P> <P>To Target Name use<BR /> | eval src_name=mvindex(Account_Name, 1)</P> <P>Example:<BR /> index=main source="WinEventLog:Security" (EventCode=4720 OR EventCode=4722) Account_Name!="*$" | eval src_name=mvindex(Account_Name,0) | eval tgt_name=mvindex(Account_Name,1) | table src_name, tgt_name</P> Mon, 28 Sep 2020 13:09:35 GMT erick_costa 2020-09-28T13:09:35Z https://community.splunk.com/t5/Getting-Data-In/Why-is-there-a-carriage-return-appended-to-the-WMI-Account-Name/m-p/79893#M16435 <P>For sourcetype="WinEventLog:Security the extraction for field Account_Name appears to be prepending a carriage return to the the value. This screws up csv output. Is behavior by design?</P> Thu, 22 Sep 2011 14:54:48 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-there-a-carriage-return-appended-to-the-WMI-Account-Name/m-p/79893#M16435 ehoward 2011-09-22T14:54:48Z https://community.splunk.com/t5/Getting-Data-In/Why-is-there-a-carriage-return-appended-to-the-WMI-Account-Name/m-p/79894#M16436 <P>to Source Name use<BR /> | eval src_name=mvindex(Account_Name, 0)</P> <P>To Target Name use<BR /> | eval src_name=mvindex(Account_Name, 1)</P> <P>Example:<BR /> index=main source="WinEventLog:Security" (EventCode=4720 OR EventCode=4722) Account_Name!="*$" | eval src_name=mvindex(Account_Name,0) | eval tgt_name=mvindex(Account_Name,1) | table src_name, tgt_name</P> Mon, 28 Sep 2020 13:09:35 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-there-a-carriage-return-appended-to-the-WMI-Account-Name/m-p/79894#M16436 erick_costa 2020-09-28T13:09:35Z