index=windows sourcetype="WinEventLog" (EventCode=1 Image IN ("*\\pchelpware_viewer.exe"))
| eval relevant_fields=case(
    EventCode=13, Details + "
   -->  " + TargetObject + "
     ",
    EventCode=1, Image + "
   -->  " + CommandLine + "
     ",
    EventCode=4697, Service_File_Name,
    1=1, "Unknown"
)
| eval type=case(
    EventCode=13, "Registry",
    EventCode=1, "Process",
    EventCode=4697, "Service",
    1=1, "Unknown"
    )
| stats values(relevant_fields) as relevant_fields, count by host, type