use Win32;
use Win32::Eventlog;

#Here we get an eventlog object.
$eventlog = Win32::EventLog->new($eventLog, $ENV{COMPUTERNAME});

#This reads a specific event log entry that corresponds to the offset supplied
$eventlog->Read(EVENTLOG_FORWARDS_READ|EVENTLOG_SEEK_READ,$offset,$hashRef);

#This retrieves all the fields in the eventlog entry
Win32::EventLog::GetMessageText($hashRef);

#Here lies the magic line--the SID stored in $hashRef->{User} will be translated
#to the real username, which gets put into $username
Win32::LookupAccountSID(undef, $hashRef->{User}, $username, $domain, $sidtype);