(
preceding text of first "%0d%0a" of following text of first "User: " of description of it | "Unknown", time generated of it,
(
if
(
it = 21
)
then
(
"New Session"
)
else
(
"Resumed Session"
)
)
of
(
event id of it
)
, following text of last ": " of description of it
)
of records
(
(
integers in
(
item 0 of it + item 1 of it - 1,maximum of
(
item 0 of it + item 1 of it - 2000;item 1 of it
)
)
)
of
(
record count of it, oldest record number of it
)
)
whose
(
exists description of it and
(
event id of it = 21 or event id of it = 25
)
and description of it does not contain "LOCAL"
)
of event log "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
(preceding text of first "%0d%0a" of following text of first "User: " of description of it | "Unknown", time generated of it, (if (it = 21) then ("New Session") else ("Resumed Session")) of (event id of it), following text of last ": " of description of it) of records ((integers in(item 0 of it + item 1 of it - 1,maximum of (item 0 of it + item 1 of it - 2000;item 1 of it))) of (record count of it, oldest record number of it)) whose (exists description of it and (event id of it = 21 or event id of it = 25) and description of it does not contain "LOCAL") of event log "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
