Event Log > Filter Current Log > XML > where EventData contains text
Solution 1
You can always use a powershell script and pass the XML through powershell's where function (supports -contains -like -match):
nv.ps1
$Query = @"
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">
*[System[(EventID=20001)]]
</Select>
</Query>
</QueryList>
"@
$events = Get-WinEvent -FilterXml $Query
ForEach ($Event in $Events) {
# Convert the event to XML
$eventXML = [xml]$Event.ToXml()
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription
Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name Data -Value $eventXML.Event.EventData.Data
}
$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView
pause
A cmd to launch it (nv.cmd):
powershell.exe -executionpolicy bypass "& '.\nv.ps1'"
Solution 2
On further investigation I came across an answer to this on Stack Overflow: https://stackoverflow.com/questions/8671194/using-xpath-starts-with-or-contains-functions-to-search-windows-event-logs
So it looks like it's not possible to do wildcard searches in the event log.
Related videos on Youtube
JohnLBevan
I work as a technical architect for an advertising company. Most of my day job revolves around ERP, Finance and Operations systems, though I also get involved with any technical issues which fall into knowledge gaps between the various IT teams' / people's roles. My (IT related) interests are more towards web applications, artificial intelligence, productivity utilities, and scripting. If you want to know more about me than that, just Google my username - it's a perfect example of how not to ensure personal privacy.
Updated on September 18, 2022Comments
-
JohnLBevan over 1 year
I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:
<QueryList> <Query Id="0" Path="Application"> <Select Path="Application">*[System[Provider[@Name='MyDemo' or @Name='AnotherDemo'] and (Level=2 or Level=3)]][EventData[Data[contains(.,'TCP Provider, error: 0')]]]</Select> </Query> </QueryList>
However this is seen as an invalid query - I'm guessing the contains statement is not recognised (as it looks like a special version of the XPath syntax is being used here. Does anyone know if what I'm attempting is possible / how to go about doing this?
Thanks in advance,
JB
-
JohnLBevan about 11 yearsThat said I'm going to play to see if I can hack a solution by creating a linked server to the event log data source in SQL or through custom code. . . Should I find a hack I'll let you guys know
-
Mladen Mihajlovic about 10 yearsDid you ever find a way?
-
bwerks over 7 yearsUnfortunately this results in pulling a potentially huge amount of events out of Get-WinEvent, which can be a problem for professional applications where those events might be getting sent over the wire.