I need to identify each Active Directory Service Accounts that are being used for authentication for my work group. I am trying to create a working list of active and disabled accounts. I am using the following, but not having any luck obtaining all Events with complete list of EventCodes.  index=xxxxxxxxxx inserted group*Svc source="xxxxxxxxx" | rex field=Account_Name "(?<Account_Name_parsed>[\w]*)\@.*" | where isnotnull(Account_Name_parsed) | eval startDate=strftime(strptime(whenCreated,"%Y%m%d%H%M"), "%Y/%m/%d %H:%M") | eval endDate=strftime(strptime(accountExpires,"%Y-%m-%dT%H:%M:%S%Z"), "%Y/%m/%d %H:%M") | eval lastDate=strftime(strptime(lastTime,"%Y-%m-%dT%H:%M:%S"), "%Y/%m/%d %H:%M") | eval Days=floor((now()-strptime(lastDate,"%Y/%m/%d %H:%M"))/(3600*24)) | rex field=userAccountControl "(?<userAccountControl_parsed>[^,]+)" | eval userAccountControl=lower(replace(mvjoin(userAccountControl_parsed, "|"), " ", "_")) | eval status=case( match(userAccountControl, "accountdisable") , "disabled", 1==1, "active" ) | stats first(_time) AS Time by Account_Name_parsed | eval Time=strftime(Time, "%b %d %H:%M:%S") The only thing showing in Statistics is the account name and time. I need for my list to show active and non-active accounts. I would also like for the Source_Workstation to be shown as well. I have attached an example of fields within an event. ... View more