When you use the subsearch's table command should assign the field name, so
[|search EventCode=4738 Account_Expires!="-" | eval Account_Name=mvindex(Account_Name, -1) |eval New_DN="\"CN=".replace(Account_Name,"."," ").",OU=Users - Disabled,DC=testdomain,DC=ca\"" | table New_DN]
should result resolve to
New_DN="CN=bruce wayne,OU=Users - Disabled,DC=testdomain,DC=ca"
You can see this has taken place after the run if you click on "Job|inspect Job"
and then "search log" in the dialog that appears.
You will be able to search for "expanded index search" (it may be a few results down) or "New_DN="
and you will see EventCode=5139 (New_DN="CN=bruce wayne,OU=Users - Disabled,DC=testdomain,DC=ca")
if there are multiple New_DNs, you will see them OR'd:
EventCode=5139 (New_DN="CN=bruce wayne,OU=Users - Disabled,DC=testdomain,DC=ca" OR New_DN="CN=clark kent,OU=Users - Disabled,DC=testdomain,DC=ca" )
... View more