Depending on how many results the first search returns, this may work
...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name
Thanks @richgalloway . This works and displays the name properly but when used with other items that need to be tabled, it's the only field that returns results. Full search:
index=azuread sourcetype="ms:aad:audit" activityDisplayName="Update service principal" OR activityDisplayName="Add service principal credentials"
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table activityDateTime, activityDisplayName, operationType, targetResources{}.displayName, targetResources{}.id, targetResources{}.modifiedProperties{}.displayName, targetResources{}.modifiedProperties{}.oldValue, targetResources{}.modifiedProperties{}.newValue, initiatedBy.user.userPrincipalName, name
I have no suggestions about that.
Depending on how many results the first search returns, this may work
...
| rex field=initiatedBy.user.userPrincipalName "ex(?<GUID>\d+)z\@"
| map search="ldapsearch domain=DEFAULT search=\"(&(objectClass=user)(exguid=$GUID$))\""
| table name