How to extract this field from my Active Directory data into a different field name?

[ccsfdave]

In my Active Directory data I have this situation:

Subject:
    Security ID:        NT AUTHORITY\SYSTEM
    Account Name:       ADDC01
    Account Domain:     AD
    Logon ID:       0x3e7
Account That Was Locked Out:
    Security ID:        MyDomain\Lightning.McQueen
    Account Name:       lightning.mcqueen

I would like to extract ADDC01 into a different field name e.g. Server_Account so that I can isolate which are users and which are servers.

Any help would be greatly appreciated!

[cmccririe · Accepted solution]

Assuming the Windows TA extracts Account Name into a multi-valued field. On my test machine, I have a field called Account_Name that has been extracted for both of these values.

Use the mvindex() function to reference a specific value in a multivalue field. Since the index numbering starts at 0 you will use the following two eval statements.

1. |eval Server_Account = mvindex(Account_Name,0)
2. |eval User_Account = mvindex(Account_Name,1)