Liam,
I was able to get your suggested code working with xsltproc.. actually I kind
of "enhanced" it a bit...
<?xml version="1.0"?>
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

<xsl:param name="input"/>

<xsl:variable name="before-tab" select=" substring-before(
substring-after($input, '='), '[Tab]' ) " />

<xsl:variable name="after-tab" select=" substring-before(
substring-after($input, '[Tab]'), ';') " />


<xsl:template match="/syslog">

<xsl:choose>
B B B  <xsl:when test="string-length($before-tab) =
string-length($after-tab)">
B B B B B B B  <xsl:message>The string-lengths of the string in front of, and
after, the [Tab] are THE SAME</xsl:message>
B B B B B B B  <xsl:message>
B B B B B B B B B B B B B B B  before: <xsl:value-of select="$before-tab" />,
B B B B B B B B B B B B B B B  after: <xsl:value-of select="$after-tab" />.
B B B B B B B  </xsl:message>
B B B  </xsl:when>
B B B  <xsl:otherwise>
B B B B B B B  <xsl:message>The string-lengths of the string in front of, and
after, the [Tab] are NOT THE SAME</xsl:message>
B B B B B B B  <xsl:message>
B B B B B B B B B B B B B B B  before: <xsl:value-of select="$before-tab" />,
B B B B B B B B B B B B B B B  after: <xsl:value-of select="$after-tab" />.
B B B B B B B  </xsl:message>
B B B  </xsl:otherwise>
</xsl:choose>

</xsl:template>

</xsl:stylesheet>

and I test with xsltproc:

xsltproc -o foo --stringparam input 'Command=Password$[Tab]Password$;'
initialparsetest.xsl auditrecord.xml
and:
xsltproc -o foo --stringparam input 'Command=Password$[TabXXXXX]Password$;'
initialparsetest.xsl auditrecord.xml

I am going to make a new post/thread about how I want to go forward after
this.
Thanks!
Jim