I noticed that the "startswith" expression does not match exactly.
startswith="Sophos Anti-Virus service entered the stopped"
The statement above created transactions containing this string:
Message=The Sophos Anti-Virus Statusreporter service entered the stopped state.
Notice that the word "Statusreporter" does not appear in the string defined as the start of the transaction. Is there a way to make it match exactly?
Sending escaped quotes to the searchmatch function of eval worked for me:
startswith=eval(searchmatch"\"Sophos Anti-Virus service entered the stopped\""))
Is the text in a field? If so an eval expression would be one solution
startswith=eval(thefieldname=="Sophos Anti-Virus service entered the stopped")
If there's further text in the field following this phrase you could use a wildcard at the end.
"Sophos Anti-Virus service entered the stopped*"
If it's not a pre-defined (persistent) field you could use rex or erex to create a transient field before the transaction command and use that in the startswith/ eval.