topic Standardizing Account_Name for Event 4769 to match others? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Standardizing-Account-Name-for-Event-4769-to-match-others/m-p/131397#M35840 <P>I'm trying to use EventCode 4769 along with several other EventCodes in a search and am running into the problem that for this code all the Account_Name fields contain the fully qualified name (name@domain) while the other fields are just the name. I need to somehow need to get the Account_Name field for this code only, to stop reading at the @ sign. </P> <P>Any thoughts would be greatly appreciated! Thank you!</P> Mon, 28 Sep 2020 16:23:15 GMT kearaspoor 2020-09-28T16:23:15Z Standardizing Account_Name for Event 4769 to match others? https://community.splunk.com/t5/Splunk-Search/Standardizing-Account-Name-for-Event-4769-to-match-others/m-p/131397#M35840 <P>I'm trying to use EventCode 4769 along with several other EventCodes in a search and am running into the problem that for this code all the Account_Name fields contain the fully qualified name (name@domain) while the other fields are just the name. I need to somehow need to get the Account_Name field for this code only, to stop reading at the @ sign. </P> <P>Any thoughts would be greatly appreciated! Thank you!</P> Mon, 28 Sep 2020 16:23:15 GMT https://community.splunk.com/t5/Splunk-Search/Standardizing-Account-Name-for-Event-4769-to-match-others/m-p/131397#M35840 kearaspoor 2020-09-28T16:23:15Z Re: Standardizing Account_Name for Event 4769 to match others? https://community.splunk.com/t5/Splunk-Search/Standardizing-Account-Name-for-Event-4769-to-match-others/m-p/131398#M35841 <PRE><CODE>| rex field=Account_Name "(?&lt;Account_Name&gt;[^@]+)" </CODE></PRE> Mon, 14 Apr 2014 23:01:42 GMT https://community.splunk.com/t5/Splunk-Search/Standardizing-Account-Name-for-Event-4769-to-match-others/m-p/131398#M35841 the_wolverine 2014-04-14T23:01:42Z Re: Standardizing Account_Name for Event 4769 to match others? https://community.splunk.com/t5/Splunk-Search/Standardizing-Account-Name-for-Event-4769-to-match-others/m-p/131399#M35842 <P>Thank you! That was exactly what I needed!</P> Mon, 16 Jun 2014 20:22:02 GMT https://community.splunk.com/t5/Splunk-Search/Standardizing-Account-Name-for-Event-4769-to-match-others/m-p/131399#M35842 kearaspoor 2014-06-16T20:22:02Z