[Admin by Request EPM]: [Logs Admin By Request - EPM] Events shows null for User Account Column

### Integration Name

Admin By Request EPM [packages/admin_by_request_epm]

### Dataset Name

admin_by_request_epm.events

### Integration Version

1.4.0

### Agent Version

9.5.1

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.5.1

### OS Version and Architecture

MacOS - Self-managed

### Software/API Version

_No response_

### Error Message

_No response_

### Event Original

_No response_

### What did you do?

1. Install the Admin By Request EPM integration.
2. Ingest sample events data stream documents (e.g. the packaged sample_event.json, which does populate user_account).
3. Open [Logs Admin By Request - EPM] Events dashboard.
4. Observe the Events table: User account column is (null) for every row, while User name populates correctly.

### What did you see?

The User Account field in the Events table at the bottom of the dashboard shows up as NULL

Both the sourceField and the panel's own existence-filter query point at admin_by_request_epm.auditlog.user.account — a field that only exists on auditlog documents. This dashboard is filtered to event.dataset: "admin_by_request_epm.events", so that field is never present and the column is always empty.

### What did you expect to see?

The "User account" column should reference admin_by_request_epm.events.user_account, matching the field that's actually populated on events documents (and matching the pattern used by every other column in the same table).

### Anything else?

In packages/admin_by_request_epm/kibana/dashboard/admin_by_request_epm-aef4665f-b43e-46f4-a635-1be3117ffc9e.json, the Lens table column for "User account" is wired to the wrong data-stream's field:

"473f3f0e-bac4-4c19-adcb-69b3cdb9c025": {
"customLabel": true,
"dataType": "string",
"filter": {
"language": "kuery",
"query": "\"admin_by_request_epm.auditlog.user.account\": *"
},
"isBucketed": false,
"label": "User account",
"operationType": "last_value",
"params": { "sortField": "@timestamp" },
"scale": "ordinal",
"sourceField": "admin_by_request_epm.auditlog.user.account"
}
Both the sourceField and the panel's own existence-filter query point at admin_by_request_epm.auditlog.user.account — a field that only exists on auditlog documents. This dashboard is filtered to event.dataset: "admin_by_request_epm.events", so that field is never present and the column is always empty.

Every sibling column on the same table (User name, Computer name, Event level, etc.) correctly references admin_by_request_epm.events.*, so this looks like a copy/paste error from the Auditlog dashboard rather than an intentional cross-reference.

**Suggested fix**
Change sourceField (and the filter query) on panel column 473f3f0e-bac4-4c19-adcb-69b3cdb9c025 from admin_by_request_epm.auditlog.user.account to admin_by_request_epm.events.user_account.

File: packages/admin_by_request_epm/kibana/dashboard/admin_by_request_epm-aef4665f-b43e-46f4-a635-1be3117ffc9e.json