Skip to content

Instantly share code, notes, and snippets.

@JohnBaek

JohnBaek/eventvwr_keyword_filtering.evtx

Last active July 7, 2016 07:52
Show Gist options
  • Save JohnBaek/37621fc52a1f3966e4e11bd45788bbff to your computer and use it in GitHub Desktop.
Save JohnBaek/37621fc52a1f3966e4e11bd45788bbff to your computer and use it in GitHub Desktop.
Download ZIP
eventvwr_keyword_filtering.evtx
Raw
eventvwr_keyword_filtering.evtx
<QueryList>
<Query Id="0" Path="file://C:\Users\john123\Desktop\test.evtx">
<Select Path="file://C:\Users\john123\Desktop\test.evtx">*[EventData[(Data='/pay/common/BillingResult.aspx')]]</Select>
</Query>
</QueryList>
//엑셀 추출 메서드
=MID(B1121,FIND(" User host address:",B1121,1)+19,15)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment