I want to have a table of deleted accounts with the attributes time, adminstrator, user, message but the administrator and users fields still remain empty
index = msad source=wineventlog:security EventCode=4726
| rex field=member_dn "(?<Administrator> S+)s+(?<User> S+)"
| table _time Administrator User action signature
and that I checked event raw, I noticed that the field membr_dn is empty have a solution?
