The <from-entity> specified in
queries using the URLSCAN input format is either the "URLSCAN"
keyword or a comma-separated list of paths of URLScan log
files.
When the "URLSCAN" keyword is used, the URLSCAN input format
extracts the URLScan log configuration parameters from the
UrlScan.ini configuration file and parses all the URLScan log files
currently available in the URLScan log file directory.
Filenames can include wildcards (e.g. "URLSCAN\UrlScan*.log").