Parsing Window Events Log

Follow

mustafa.a.alamin

• March 25, 2014 18:47

HI,  

 

I have been trying to parse out type out of the windows logs. Every time I run the query the system will parse out the event type instead of type. Are you aware of another way to parse out type from the Windows event logs ? Please see the attached file. 

Thanks, 

0

• 

  Kevin Keech

  • March 26, 2014 05:06

  In Event logs the "Type" is typically a string whereas "EventType" is an integer. This means the "Type" value is usually surrounded by quotes, but the EventType value is not. So with this in mind the following parse statement should work.

  | parse "Type = \"*\";" as type

   

  0

  Comment actions Permalink
• 

  mustafa.a.alamin

  • March 26, 2014 14:24

  That worked perfectly.  Thank you !

  0

  Comment actions Permalink

Please sign in to leave a comment.