Windows event message field

how can I parse message string to seperate lines?
Line1 = An account was logged off.

Line2 = Security ID: XXXX
Line3 = Account Name: XXXX
Line4 = Account Domain: XXX
Line5 = Logon ID: 0xXXXXX

Line6 = Logon Type: 3

Line7 = This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

Now if I want create Data Table i can't use this field on split rows sub aggregation Terms and in Field this message filed not show.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.