Collecting Specific Error Events from SCCM Agents

What are you going to do with the data?

CMPivot or create a custom inventory item. but it will depend on what you are going to do with the data.

Hi,

Hope you are doing well.

Agree with Garth. Here is an example to use the CMPivot tool to query all Windows devices with a specific event error 10010 in my lab. You can customize the syntax accordingly.

EventLog('System')| summarize countif( (EventID == 10010) ) by Device| where (countif_ > 0)

Here is a guide to use CMPivot:

CMPivot for real-time data in Configuration Manager

Best regards,

Simon

If the response is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hi,

Hope everything goes well. Do you need any further assistance about this issue? If yes, please feel free to let us know, we will do our best to help you.

If the response is helpful, it's appreciated that you could click "Accept Answer" and upvote it, this will help other users to search for useful information more quickly.

Thanks for your time.

Best regards,

Simon