4

Hello, in this section i want to know how to filter an event which contain Data with some words, for example:

Right Syntax:

*[EventData[Data[@Name='SourceAddress'] ='192.168.1.2']]

result: search all Events which Source Address = 192.168.1.2.

but i want to search all Events which contain LIKE 192.168.

Wrong Syntax:

*[EventData[Data[@Name='SourceAddress'] Like '192.168.']]
Improve this question
1

1 Answer 1

Reset to default
3

I want to search all Events which contain LIKE 192.168.

Unfortunately I don't think that is directly possible, because:

Windows Event Log supports a subset of XPath 1.0. There are limitations to what functions work in the query. For instance, you can use the "position", "Band", and "timediff" functions within the query but other functions like "starts-with" and "contains" are not currently supported.

Source Advanced XML filtering in the Windows Event Viewer

However, as w32sh pointed out in a comment, it is possible with PowerShell. See this Stack Overflow question: Using XPath starts-with or contains functions to search Windows event logs

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .