How to create a table with the names of the users deleted?

[hichem_khalfi]

I want to have a table of deleted accounts with the attributes time, adminstrator, user, message but the administrator and users fields still remain empty

index = msad source=wineventlog:security EventCode=4726
| rex field=member_dn "(?<Administrator> S+)s+(?<User> S+)"
| table _time Administrator User action signature

and that I checked event raw, I noticed that the field membr_dn is empty have a solution?

[ITWhisperer]

If the field is empty, what should be in it?