Spunk by itself extract all fields where there's = (e.g. EventCode=4723).
Timestamp is automatically extracted.
The other fields can be extracted using regexes.
As first thing, install on your Search Head Splunk TA_Windows ( https://splunkbase.splunk.com/app/742/ ) so you already have all the needed extractions; if you're not satisfied and you want more fields, use regexes, e.g. to exctract Account Name after Subject, use something like this (sorry if my logs are in italian!):