If you know the time frame it makes it a bit easier as it cuts down on the number of logs you need to search. Search the log for the event name (in this case TEST.DEMO1) and you should find a few entries. Here is an example of me suspending an event, and it logs my user id.
20190117 14:17:59.085 [facade:request] [INFO] RMI TCP Connection(17535)-10.2.15.136: [2019-01-17_14:17:59.085] OperationalFacade.suspend() request: userToken=[UserToken[userId=AR54389,tokenId=8273496323502036992]], eventNames=[TEST.DEMO1]
If you don't know the time frame, Agent Ransack is good tool to quickly search the contents multiple files.
FYI: this is from the tracelog that is found in %instlal folder%\logs