Hi jsnair

I think you'll need to set up your Log Parser to read the format of the log file at least up to the portion that you're interested in. It's extra work but the Log Parser is dumb and it's unable to guess which portion of the log file you're interested in unless you do it that way. For example, in the log file you posted you'd want something like:

#DateVariable#

Application: #ServiceVariable#

Error State: #StateVariable#

That's the minimum you'd need to get you the info you're looking for - in this case the state variable.

I will post this as the answer... obviously more was added to the intial request.. but here it is:

#get last time the powershell script was run

$LastRunStamp = (Get-Item c:\test\lastRunStamp.txt).LastWriteTime.DateTime

#write current timestamp to file

Get-Date > c:\test\lastRunStamp.txt

foreach ($file in (Get-ChildItem c:\test\*.xml))

{

   #calculate the time difference between file modified time and last time script was run    

   $span = new-timespan -start $file.LastWriteTime.DateTime  -end $LastRunStamp

    #if the file was modified since the last time the  script run value will be less than 0    

   if($span.TotalSeconds -le 0)

   {

               #instantiate XML document object

               $xdoc = new-object System.Xml.XmlDocument

               #load up the XML contents into the object

               $xdoc.load($file)

               #check the value of the priority XML tag if  it contains Major then write to event log

               if ($xdoc.SelectSingleNode("//priorityname").innertext -eq 'Major')

               {

                   #get the content of XML

                   $content = [string]([IO.File]::ReadAllText($file.FullName))

                   #mask the FQDN's

                   $content = $content.replace(".ngd.com",".censored").replace(".ad.local",".censored FQDN")

                   #regex pattern to detect IP Addresses

                   $pattern = "\b((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b"

                   #use regex to mask IP addresses

                   $contentScrubbed = [regex]::replace($content, $pattern, "sensored IP Address")  

                   Write-EventLog –LogName Application –Source “Verint Alert” `

                   –EntryType Information –EventID 1 `

                   -Message ("Triggered Alarm") + $contentScrubbed

               }                                  

   }

}