win32_NTlogEvent query InsertionStrings property

Question

I would like to accomplish something similar to:

SELECT * FROM win32_NTlogEvent WHERE logfile = 'application' AND insertionStrings LIKE '%searchString'  

I know that insertionString is a string array. so I am unsure of how to access its values with WQL.

Answer 1

You can use (Powershell):

Get-EventLog -Logname "Application" | ?{$_.Message -like "*$STRING*"}

This would get all entries in the application log, with the message that matches the $string value. Is this what you're after?