This may help.. |makeresults | eval _raw="LogName=LoginPI Events EventCode=1300 EventType=4 ComputerName=RNBSVSIMGT02.rightnetworks.com SourceName=Login Threshold Exceeded Type=Information RecordNumber=285782 Keywords=Classic TaskCategory=None OpCode=Info Message={ \"Description\": \"Total login time (48s) exceeded threshold of 45s (6.67%)\", \"Actual value\": \"48\", \"Threshold value\": \"45\", \"AccountId\": \"4c06e54e-ab5f-47a6-2cc7-08d807c9fae2\", \"AccountName\": \"rightnetworks\\eloginpi049\", \"LauncherName\": \"RNBSVSI21\", \"Locale\": \"English (United States)\", \"RemotingProtocol\": \"Rdp\", \"Resolution\": \"1920 × 1080\", \"ScaleFactor\": \"100%\", \"TargetHost\": \"BPSQCP00S143\", \"TargetOS\": \"Microsoft Windows Server 2016 Standard 10.0.14393 (1607)\", \"EnvironmentName\": \"BPSQCP00S143\", \"EnvironmentId\": \"06a3c4a2-6f73-4c54-94e9-08d8040960f8\", \"Title\": \"Login time threshold exceeded" | rex field=_raw "Actual value\\\":\s+\\\"(?<actual_value>\d+)"
... View more