How to split out the Windows Event Log Description field with formula 1

[michbell]

I'm trying to use CR to run more manipulate-able reports of the windows event log. The problem is that most of the info I need to be able to split out is in the field "description". Here's an example of what's contained in this field:

The Windows Filtering Platform has blocked a connection.

Application Information:
Process ID: 516
Application Name: \device\harddiskvolume2\windows\system32\svchost.exe

Network Information:
Direction: Inbound
Source Address: 255.255.255.255
Source Port: 5200
Destination Address: 10.1.10.27
Destination Port: 57094
Protocol: 0

Filter Information:
Filter Run-Time ID: 85988
Layer Name: Receive/Accept
Layer Run-Time ID: 44​

I want to be able to split out each line, basically. So I want to have a formula for Application Name that only returns "\device\harddiskvolume2\windows\system32\svchost.exe" and another formula for Destination Address that returns "10.1.10.27". Since the number of characters before and after each of these lines will vary, I can't use Right(,) or Left(,).

Anybody have an easy way to do this? Thanks in advance!

 

[michbell]

There might be a better way to do this, but I was able to get the fields out by using a combination of trimming left and right. For Source Address, this is what I did:

trim(
left(
trim(right({Security.Description}, length({Security.Description})- 16 - instr({Security.Description}, "Source Address:")))
,-11 + instr(trim(right({Security.Description}, length({Security.Description})- 16- instr({Security.Description}, "Source Address:"))), "Source Port:")
)
)

 

[CoSpringsGuy]

split({Source Address},":")[2]



split({Application Name},":")[2]


_____________________________________
Crystal Reports 2008 and XI
Intersystems Cache 2012 ODBC connection

 

[michbell]

That's a bit less complicated! hahaha. Thanks CoSpringsGuy!!!!

 

[lbass]

Create two formulas:

//{@ApplicationName}:
stringvar x := {table.field};
stringvar y := extractstring(x,"Application name: ",chr(13));

//{@DestinationName}:
stringvar x := {table.field};
stringvar z := extractstring(x,"Destination Address: ",chr(13));

-LB