index=windows sourcetype="WinEventLog" (EventCode=13 TargetObject="*Software\\Veyon Solutions\\*") OR (EventCode=1 Image IN ("*\\veyon-wcli.exe", "*\\veyon-service.exe", "*\\veyon-server.exe", "*\\veyon-worker.exe", "*\\veyon-master.exe")) OR (EventCode=4697 Service_File_Name="*veyon*")
| eval relevant_fields=case(
    EventCode=13, Details + "
   -->  " + TargetObject + "
     ",
    EventCode=1, Image + "
   -->  " + CommandLine + "
     ",
    EventCode=4697, Service_File_Name,
    1=1, "Unknown"
)
| eval type=case(
    EventCode=13, "Registry",
    EventCode=1, "Process",
    EventCode=4697, "Service",
    1=1, "Unknown"
    )
| stats values(relevant_fields) as relevant_fields, count by host, type