lets say i have user1 for which i need to check who has modified, i have many groups so i cannot give them, will the below syntax work for me.
index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now
| rename user1 AS "Actioned By", user1_first AS "First Name" user1_last AS "Last Name" name as "Action Taken"
| rex mode=sed field="Account_Name" "s/CN=//g"
| rex mode=sed field="Account_Name" "s/cn=//g"
| rex mode=sed field="Account_Name" "s/,OU.*//g"
| rex mode=sed field="Account_Name" "s/\\//g"
| table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time
| sort - _time
... View more