Here are some key code fragements from an old but functional program I wrote/plagerized. (/msg me for complete code). This should assist you in getting relevant parts of your event record. 
my %EventType = (0,'Error',2,'Warning',4,'Information',
                 8,'Audit success',16,'Audit failure');

$Win32::EventLog::GetMessageText =1;    # Automatically call GetMessag
+eText on each msg retrieved

....

  while ($limit--){
      $EventLog->Read((EVENTLOG_SEQUENTIAL_READ|EVENTLOG_BACKWARDS_REA
+D),0,$event);
      #to get a readable EventId
      #print "." if $limit % 100 == 0;
      $event->{'EventID'} = $event->{'EventID'} & 0xffff;
      $FindEventType and next unless $FindEventType ==   $event->{'Eve
+ntID'};
      Print_Event();
  }

....
#############################################
sub Print_Event{
        my ($sec,$min,$hour,$mday,$mon,$year,$sday,$yday,$isdst) = loc
+altime($event->{'TimeGenerated
'});
        $year += 1900;
        $mon +=1; # Zero-based
        if ($OptCSV){
           print "$year/$mon/$mday $hour:$min,";
           print $event->{EventID} . ",";
           $event->{'Strings'} =~ tr/\0/,/;
           print  $event->{'Strings'} ."\n";
           return;
        }
        print sprintf(" TimeStamp->%02d\-%02d\-%02d, %02d:%02d ",,$yea
+r,$mon,$mday,$hour,$min);

        #readable EventType
        $event->{'EventType'} = $EventType{ $event->{'EventType'} };
        #split the strings
        $event->{'Strings'} =~ tr/\0/\n/;
       # $event->{'Strings'} =~s/\s*\n*$//; # Zap trailing NewLines & 
+white-spaces..

        foreach my $key (qw (EventType RecordNumber Category Source Ev
+entID) )#
                {
                print sprintf( "%s->%s  ",$key, $event->{$key} );
                }

        print "\n\[$event->{Strings}\]\n";
        #print "MESSAGE:\[$event->{Strings}\]\n";
}
#############################################

[download]

     "An undefined problem has an infinite number of solutions." - Robert A. Humphrey         "If you're not part of the solution, you're part of the precipitate." - Henry J. Tillman

In reply to Re: Extracting useful information from Windows Event Logs by NetWallah
in thread Extracting useful information from Windows Event Logs by saadatsaeed

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.