Hello @MCK ,
You can add *[EventData[Data and (Data="Test2")]]
. The following is an example:
<QueryList>
<Query Id="0" Path="Application">
<Select Path="Application">
*[System[(EventID=4002)]]
and
*[EventData[Data and (Data="Test2")]]
</Select>
</Query>
</QueryList>
Update:
Above filter applies to <Data>Test2<Data>
since it use equal sign (=).
In your case, wildcard is required because there are many other sub-strings contained in addition to "Test2", and it has some variable part like time etc. Since XPath supported in Windows Event Log are limited. Wildcard is not supported in data value. So maybe you can use powershell command like this:
Get-EventLog -LogName "Application" -Source "nsService" | ?{$_.Message -like "*Test2*"} | Out-GridView
Thank you!
If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
To specify this before I have added the line, the task is triggered with every backup regardless of the name. If I add the line, the task is no longer triggered at all.
Hello @MCK , I convert your answers to comments because they are not "answer". I update my answer to include a another way to do it you can check if it helps.
Hello RitaHan,
So it is right, that i can't check the events Data for a substring with the trigger ?
You can use PowerShell script as pointed in my answer instead.
Thank you very much.
Sign in to comment