I updated the search and it's still not working.
index=security "An account was successfully logged on." [search index=randomlogs host=employeetermlist20140311 | rex "(?i)^(?:[^,],){2}(?P [^,]+)" | rex "(?i) .?,(?P \d+/\d+/\d+)(?=,)" | rename ADAcctName AS Account_Name | table Account_Name termdate | fields Account_Name, termdate] | eval NewAccount_Name=mvindex(Account_Name, 1) | stats max(_time) by NewAccount_Name | rename max(_time) AS Last_Login | eval Last_Successful_Login=strftime(Last_Login, "%m/%d/%Y") | table NewAccount_Name termdate Last_Successful_Login
... View more