DPL Helping with parsing (Locked User, windows event ID 4740)

[Etienne1]

Hello,

I'm having trouble with my DPL analysis, I would like to obtain these lines only:

(In Account That Was Locked Out)
Security ID:
Account Name:

(In Additional Information)
Caller Computer Name:

Here is the content of the log:

A user account was locked out.

Subject:
              Security ID:                            Example1
              Account Name:                      Example2$
              Account Domain:                   Example3
              Logon ID:                                Example4

Account That Was Locked Out:
               Security ID:                            Example5
               Account Name:                      Example6

Additional Information:
              Caller Computer Name:          Example7

Thanks in advance

[Etienne1 · Accepted solution]

I managed to solve the problem, if that helps some people.

In DPL Architect : 
DATA "Account That Was Locked Out:" SPACE "Security ID:" LD:Security_ID EOL SPACE "Account Name:" LD:Account_Name EOL SPACE "Additional Information:" SPACE "Caller Computer Name:" LD:Caller_Computer_Name

In DQL :

fetch logs
| filter matchesValue(winlog.eventid, "4740")
| parse content, """DATA "Account That Was Locked Out:" SPACE "Security ID:" LD:Security_ID EOL SPACE "Account Name:" LD:Account_Name EOL SPACE "Additional Information:" SPACE "Caller Computer Name:" LD:Caller_Computer_Name"""
| fields Security_ID, Account_Name, Caller_Computer_Name