Im trying to create a calculated items that read from log and tell if some string is present on this log and show 0 or 1 if present. Is something like this for example:
I have an item that colled from event log this
eventlog[Security,,,,4647,,skip]: is working if user log off show on item. So with that im trying to know what users execute log off with something like this:
Calculated Item
logeventid("eventlog[Security,,,,4647,,skip]",username)
What im intent is to read all log from this item on calculated item and search for username. I was trying to find examples of logeventid calculted items but couldnt find a single one
. Pleas Help. 
I have an item that colled from event log this
eventlog[Security,,,,4647,,skip]: is working if user log off show on item. So with that im trying to know what users execute log off with something like this:
Calculated Item
logeventid("eventlog[Security,,,,4647,,skip]",username)
What im intent is to read all log from this item on calculated item and search for username. I was trying to find examples of logeventid calculted items but couldnt find a single one
. Pleas Help.