I'm trying to use EventCode 4769 along with several other EventCodes in a search and am running into the problem that for this code all the Account_Name fields contain the fully qualified name (name@domain) while the other fields are just the name. I need to somehow need to get the Account_Name field for this code only, to stop reading at the @ sign.
Any thoughts would be greatly appreciated! Thank you!
| rex field=Account_Name "(?<Account_Name>[^@]+)"
Thank you! That was exactly what I needed!