This appears to be an old post, but for the sake of others looking for solutions, the win event id does return account name fields. Sometimes, if your running in smart mode, you may not see all fields, so I recommend using verbose mode, then extract the fields you need. I noticed the Account_Name field has more than one entry, so it helps to add a | eval user = mvindex(Account_Name, 0) to filter out unwanted info. ... View more