I had to use "New Logon:" since the "Account Name:" appeared multiple times and grabbed the first one which is not what i wanted.
Code: Select all
[substr("%NTEventText%", indexof("%NTEventText%","New Logon:"), 100) getword 8]
Code: Select all
[substr("%NTEventText%", indexof("%NTEventText%","New Logon:"), 100) getword 8]