foreach $line () { chomp($line); ($logtype, $date, $time, $type, $eventid, $status, $systemevent, $ntauth, $hostname, $description) = split(",", $line); # So, $description becomes #Special privileges assigned to new logon:^` User Name: GHOST01$^` Domain: US^` Logon ID: (0x0 0x15307D9E)^` Privileges: SeBackupPrivilege^` SeRestorePrivilege^` SeDebugPrivilege^` SeChangeNotifyPrivilege # I just need to get the User Name which is GHOST01$ out. if ($eventid==576) { ($desc, $username) = split("`", $description); ($logon, $uname) = split(":", $username); print $uname; } }