1513583, clarified events are created during system startup.

john-par · john-par · commit e63292cdb9dc · 2019-04-18T15:55:55.000-07:00
diff --git a/articles/azure-monitor/platform/custom-fields.md b/articles/azure-monitor/platform/custom-fields.md
@@ -76,7 +76,7 @@ You can view a list of all custom fields in your management group from the **Adv
 There are two ways to remove a custom field.  The first is the **Remove** option for each field when viewing the complete list as described above.  The other method is to retrieve a record and click the button to the left of the field.  The menu will have an option to remove the custom field.
 
 ## Sample walkthrough
-The following section walks through a complete example of creating a custom field.  This example extracts the service name in Windows events that indicate a service changing state.  This relies on events created by Service Control Manager in the System sign on Windows computers.  If you want to follow this example, you must be [collecting Information events for the System log](data-sources-windows-events.md).
+The following section walks through a complete example of creating a custom field.  This example extracts the service name in Windows events that indicate a service changing state.  This relies on events created by Service Control Manager during system startup on Windows computers.  If you want to follow this example, you must be [collecting Information events for the System log](data-sources-windows-events.md).
 
 We enter the following query to return all events from Service Control Manager that have an Event ID of 7036 which is the event that indicates a service starting or stopping.
 
