I have written the following expression to extract data from an event description
event.description[/Logon Type:\2/]
This only extracts the string 'Logon Type' for all entries in the event log, it does not show any event entries that have logon type 2.
Any ideas whats missing with this expression?
|