Show classic positional EventData fields as "Parameter N"

[jschick04]

Summary

Classic positional events (e.g. Microsoft-Windows-CAPI2 4192) expose a provider template whose <data> node names are Windows-synthesized placeholders %1..%N. The raw event data is unnamed and positional, so no real field names exist. EventLogExpert rendered those raw %1..%N as field labels, which diverged from Windows Event Viewer (which shows such fields positionally as "Parameter N").

This normalizes an all-placeholder template's field names to "Parameter N" at template-analysis time, so the DetailsPane, filter field/value picklists, and column storage all read the friendly label.

Evidence

The reported event is CAPI2 4192 in the Application log. Its raw <EventData> is positional/unnamed:

<EventData><Data>MsSense.exe</Data><Data></Data><Data>CodeSigning</Data>...</EventData>

The %1..%18 labels came only from EventLogExpert applying the provider template's synthetic node names; Event Viewer never surfaces %1 as a field label.

Approach

• Normalize in TemplateAnalyzer.BuildInfo, gated on the template being entirely synthetic (%[1-9][0-9]*); any real name present leaves the template untouched.
• The label flows from the cached per-template schema to every consumer with no consumer changes.
• The length-provider visible/all split is computed on the original names, so it stays byte-identical.

Performance

Normalization runs once per unique template behind the existing GetTemplateInfo cache (not per event). Measured delta (Release, worst-case cold-cache):

• Synthetic template: +566 ns / +864 B per parse (the N "Parameter N" strings).
• Normal named template: +0 B (gate early-exits on the first real name).

Testing

• New SyntheticFieldNameNormalizationTests (19): gate, canonical-ordinal boundaries (%0/%01/%1a/space/sign/Unicode-digit rejected), length-provider split, name/out-type lockstep, and a sealed column-store round-trip (Parameter 1 resolves, %1 no longer does).
• DetailsPane label lock + filter picklist lock.
• Full solution builds; suites green (Eventing 735, Filtering 1358, Runtime 2031, Scenarios 674, UI 1190).

Compatibility

• No built-in scenario references %N (all 21 catalogs swept).
• Saved filters / filter library / exported scenarios keyed on a raw %N field will stop matching and can be re-pointed at "Parameter N"; the in-memory event store is rebuilt on each log open, so no migration is required.
• Known low residual: because provider field names are free-form (not NCNames), if a real provider ever names a field exactly "Parameter N" it would over-match in the filter picklist (graceful; filter-only).

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.