Standardizing Account_Name for Event 4769 to match others?

[kearaspoor]

I'm trying to use EventCode 4769 along with several other EventCodes in a search and am running into the problem that for this code all the Account_Name fields contain the fully qualified name (name@domain) while the other fields are just the name. I need to somehow need to get the Account_Name field for this code only, to stop reading at the @ sign.

Any thoughts would be greatly appreciated! Thank you!

[the_wolverine · Accepted solution]

| rex field=Account_Name "(?<Account_Name>[^@]+)"

[kearaspoor]

Thank you! That was exactly what I needed!