We noticed that Microsoft OWA logs produce a repeating field. How can we make them into individual ones instead of just picking up the first hit?
E.g. the Param field in the log below.
`11/17/2017 1:45:05 PM Server="SERVER" User="EMAIL@Email.com" Identity="stuff" Cmdlet="New-InboxRule" Param="-SubjectContainsWords 'Account limit has been exceeded'" Param="-DeleteMessage 'True'" Param="-Name 'Subject contains 'Account limit has been exceeded''" Param="-StopProcessingRules 'True'" Param="-Force 'True'" Param="-AlwaysDeleteOutlookRulesBlob 'True'" Success="True" Error="None"`
↧
