Is the file comma delilited or tab delimited?
I thought you were looking for event 560?
I think the EventID is on the sixth position.
I think splitting the lines would give a more certain result.
Code:
If Not Split($x,",")[5] = "560"
;If Not Split($x,Chr(9))[5] = "560" ;if TAB delimited
;Write stuff $x to file2.txt
EndIf
