Home / server / Questions / 827016
Accepted
A_L
Asked: 2017-01-19 05:19:49 +0800 CST

How to filter windows event log with wildcard?

  • 772

According to the document here, the asterisk wildcard is supported and hence it should work in eg.

*[EventData[Data[@Name='TargetUserName'] ='User1*']]

but I cannot get any wildcard filter to work - has anyone been able to do this?

xml windows-event-log eventviewer

2 Answers

  1. Use Powershell

    Get-EventLog -LogName "System" | ?{$_.Message -like "*YourSearchString*"} | Out-GridView
    • 12
  2. Best Answer

    The XPath selector must begin with *, however you cannot use * to filter fields as Xpath 1.0 has no contains operator.

    https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer/

    XPath 1.0 Limitations: Windows Event Log supports a subset of XPath 1.0. There are limitations to what functions work in the query. For instance, you can use the position, Band, and timediff functions within the query but other functions like starts-with and contains are not currently supported.

    • 4