Beating my head in trying to create a report on Specific Event IDs

JVFAB

I'm really new to SolarWinds (and SWQL for that matter), and what I am looking for is to create a report for all our Windows machines being monitored that will show how many times a specific Windows ID has been triggered in the environment, but that same thing for about 15 different event IDs. 

I've dug through the reports, online documentation, tried component monitors (which seem reliant on finding a copy of the event to monitor in the first place, which isn't ideal.

I tried to create an application template I can pull into the report, but the template itself doesn't seem to be configured right:

All in all, I just need to find a way where I can replicate what we already do with the event logs we are forwarding to Azure, but in Solarwinds, so I can generate automatic reports off of them (and example of how the data looks in Azure):

I am looking to put together a similar report in Solarwinds and no idea where to start.  Any help is appreciated.

weston.hood

I can probably help. But definitely need more info. Your component monitor looks correct, assuming the correct EventIDs are plugged in. And it looks like you have results from Event ID's 4732 & 4720. What data are you missing from the Event Log component monitor that you need to see? And secondly; exactly which data fields are you looking to display via swql table?