I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">*[System[Provider[@Name='MyDemo' or @Name='AnotherDemo'] and (Level=2 or Level=3)]][EventData[Data[contains(.,'TCP Provider, error: 0')]]]</Select>
</Query>
</QueryList>
However this is seen as an invalid query – I'm guessing the contains statement is not recognised (as it looks like a special version of the XPath syntax is being used here. Does anyone know if what I'm attempting is possible / how to go about doing this?
Thanks in advance,
JB
Best Answer
You can always use a powershell script and pass the XML through powershell's where function (supports -contains -like -match):
nv.ps1
A cmd to launch it (nv.cmd):