Identity Field

substr(concat(eventlogs.logname,’ ‘, eventlogs.eventid,’ – ‘, replace(replace(replace(replace(replace(replace(eventlogs.message,’\”, ”),’\”‘, ”),’\’, ”), ‘\t’, ”), ‘\r’, ”), ‘\n’, ”)), 1, 150)

Additional Condition

(eventlogs.Source = ‘MSSQLServer’ or eventlogs.Source = ‘sqlserveragent’) and eventlogs.EventID in (‘3041′,’208′,’18210’) and eventlogs.EventType <> ‘2’ and timegen > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY)