MicrosoftHello,
I'm trying to apply this function to SQL logs that arrive in WindowsEvent table because we use WEF. I have made some changes to reflect this but having struggles with parsing the fields. If you look at the screenshot below, you can see we should use Provider contains "MSSQL" instead of Source contains "MSSQL". Also actual event details land in EventData instead of RenderedDescription. However, there is a problem here. EventData contains "01" row?column? and I'm not able to escape this but also starts with "audit_scheme_version" rather than "audit event" like in the preparsed log example you showed. Any ideas how I can get this work? 🙂
