Two questions.
1 As it is this just seems to be setting up syslog on a new port. What do we gain over using 514?
2 Would it be easy to secure this with SSL?
Ian
The timechart command can do a lot more than you are asking of it for instance if you want daily totals split by printer, you can use
host="printserver" source="WinEventLog:System" Pages="*" | timechart span=1d sum(Pages) as Pages/day by print…