I know this is a really old post, but this is exactly what I think I need to do.  I am too much of a noob to follow this.  Are you still out there? Specifically, I want to search for Windows Security 4776 sucess events, deduplicate the list based on the value in the "Logon Account:  UserX" string within the events message field.  SO I think I need to extract the "Logon Event: UserX" sting so the filed is Logon Account: and the Dedup is applied to the value of that field     ... View more