title: LogParser - Event log data value substitution
body: <p>I'm not much of a scripting wiz and I have a small requirement to analyse the Windows security Event logs for firewall traffic. </p>
  
  <p>To that end I've started looking at LogParser and it seems to do pretty much everything I need, but I'm having a little trouble working out how to substitute certain values extracted from the logs, into something more readable.</p>
  
  <p>My script is very simple:</p>
  
  <pre><code>SELECT
  TimeGenerated AS Time,
  EventTypeName AS Event,
  EXTRACT_TOKEN(Strings, 0,'|') AS ProcessID,
  EXTRACT_TOKEN(Strings, 1,'|') AS Process,
  EXTRACT_TOKEN(Strings, 7,'|') AS Protocol,
  EXTRACT_TOKEN(Strings, 2,'|') AS Direction,
  EXTRACT_TOKEN(Strings, 3,'|') AS SourceAddress,
  EXTRACT_TOKEN(Strings, 4,'|') AS SourcePort,
  EXTRACT_TOKEN(Strings, 5,'|') AS DestinationAddress,
  EXTRACT_TOKEN(Strings, 6,'|') AS DestinationPort
  FROM Security
  WHERE EventID IN (5152; 5153; 5154; 5155; 5156; 5157; 5158)
  </code></pre>
  
  <p>Although this produces the information I'm interested in, I'd like, if possible, to change the output. For exampleThe 'Process' column output is:</p>
  
  <p>\device\harddiskvolume2\apps\mozilla\fx-4\firefox.exe</p>
  
  <p>What I'd really like is to just display the process name, without the path. Likewise the 'Protocol' column just displays the numeric protocol value. I prefer to have it display the 'actual' protocol.   </p>
  
  <p>Lastly, the Direction column displays a numerical value %%14592 and %%14593 and I'd prefer to see In and Out respectively.</p>
  
  <p>If anyone can help, I'd be most grateful.</p>
  
  <p>Thanks</p>