in reply to Extracting useful information from Windows Event Logs

Dump the $hashRef and look at what is in it. I suspect that the individual data items are already separated out in there so you don't need to generate the text version of the event and don't need to parse the items out of that.

- tye        

  • Comment on Re: Extracting useful information from Windows Event Logs (look)

Replies are listed 'Best First'.
Re^2: Extracting useful information from Windows Event Logs (look)
by Util (Priest) on May 25, 2007 at 04:02 UTC

    ++tye; you are correct!
    $hashRef->{Strings} is a string containing the data items joined by NULL characters.