0

Windows Events have an ability to filter by XPATH (which is a fast search). I have sucessfully using the PowerSHell Cmdlet Get-WinEvent filtered where a specific value is a specific value as shown below

$qry = "*[(EventData/Data[@Name='TaskName'] ='\Microsoft\Windows\Diagnosis\Scheduled') ]"                                   
Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational -FilterXPath         $qry -ErrorAction SilentlyContinue  -MaxEvents 3

However i don't really want to filter by a specfic task name but a substring of it, a start-with of contains or something.. for instance in the above scenario i want to do "startswith" \Microsoft\Windows\Diagnosis . However all the different techniques i've tried, that seem like standard XPATH 1.0 syntax such as

$qry = "*[starts-with(EventData/Data[@Name='TaskName'] ,'\Microsoft\Windows\Diagnosis') ]"

give an error Get-WinEvent : The specified query is invalid

klumsy
  • 4,081
  • 5
  • 32
  • 42
  • This is *not* XPath -- sorry. Any true XPath answer will likely produce an error in your case. Notice that you are using the `\` character, but in XPath the `/` character must be used instead. – Dimitre Novatchev Apr 21 '12 at 03:49

1 Answers1

2

Try the contains function:

$x = [xml] '<root><books><book title="Foo" /></books></root>'
$x.SelectSingleNode('//book[contains(@title, oo)]')

Reference for xpath string functions: http://msdn.microsoft.com/en-us/library/ms256180.aspx

Your's may look like:

"*[EventData[contains(Data,'\Microsoft\Windows\Diagnosis\Scheduled')]]"
Andy Arismendi
  • 50,577
  • 16
  • 107
  • 124
  • 1
    That also produces the "the specific query is invalid". I'm wondering if there is a subset of XPATH going on with the filter search engine on windows events. – klumsy Apr 21 '12 at 01:20
  • @klumsy I've been playing around with it a bit and its looking like the FilterXPath param doesn't support xpath functions. – Andy Arismendi Apr 21 '12 at 19:15
  • Windows Event log uses a subset of xpath http://stackoverflow.com/a/8671523/567547 – akousmata Dec 08 '16 at 15:43