Copy winlog.user.name (if present) to user.name (if missing)

hi @_finack, is this the same issue as User.name field for event ID 4104? If not can you clarify?