First, do this ...
index=wineventlog ("4624" OR "4648") | head 3
Look at the returned events and find the names of the fields for EventID, Account_Name, host
Then do something like this (modify field names as needed) ...
index=wineventlog (EventID=528 OR EventID=540 OR EventID=552 OR EventID=4624 OR EventID=4648)
Account_Name="userid"
Check the interesting fields and verify if the host
has been extracted correctly.
Because I am in a massively heterogeneous environment, dealing with unix and windows OSs going back quite a few versions, my search time extraction of those fields and a couple of others is actually about 35 lines long. Hopefully, you only have to deal with a couple of versions of windows, and the 3-digit EventIDs are not even relevant to you.
index= wineventlog
@whitt do you know what index the events live in and if the event contains the information you are looking for all in one event? Providing a sample event would be a good place to start so we can help you construct the search.