Hi ITWhisperer, Thanks for taking the time to respond. I had thought I had responded to this, but it seems the forum ate my reply. Mock Output: _______________________________________________________________________________ Time Designated_Field Sub-Field Name 21:21 01 - Logon User Host Domain 21:22 02 - Logoff User Host Domain 21:23 04 - IP Address Assigned Host Domain NS Server IP Type _____________________________________________________________________________ NOTE: Designated_Field is a field, whose values are extracted and displayed per event, in the third column are the sub-field names associated with the values in the second column.
... View more