none
Event Log XML Query folder path RRS feed

  • Question

  • Hi 

    Trying to filter security logs in event viewer on a specified folder.  

    <QueryList>
      <Query Id="0" Path="Security">
        <Select Path="Security">
       *[EventData[Data[@Name='ObjectName'] and (Data='D:\folder\folder\folder')]
      </Select>
      </Query>
    </QueryList>

    Gets query error Invalid. 

    What am I doing wrong?

    • Moved by Bill_Stewart Wednesday, September 4, 2019 7:51 PM This is not event log XML query training forum
    Thursday, April 4, 2019 10:39 AM

All replies

  • <QueryList>
        <Query Id="0" Path="Security">
            <Select Path="Security">
                *[EventData[Data[@Name='ObjectName' and Data='D:\folder\folder\folder']]]
            </Select>
        </Query>
    </QueryList>
    


    \_(ツ)_/

    Thursday, April 4, 2019 11:12 AM
  • Okay so I don´t get the error any more with above script 
    Thanks, but I don´t get any result either so, 
    What is wrong?

    Thursday, April 4, 2019 11:39 AM