I have this data from Windows security logs and in the message section you have 2 version of the account name: I am only interested in the value of the second account string but I get both when putting into a table. In this result set, Account Name is used in both the subject and the Account is locked section of the Message value;
If my search is:
sourcetype=WinEventLog:Security EventCode=4740 ComputerName="AD*" |table _time Account_Name Caller_Computer_Name
I get both account names;
08/08/2012 03:32:32 PM
SourceName=Microsoft Windows security auditing.
TaskCategory=User Account Management
Message=A user account was locked out.