Creating a custom view
Use the Microsoft Event Viewer to create custom views, which can filter events for severity, source, category, keywords, or specific users.
WinCollect log sources can use XPath filters to capture specific events from your logs. To create the XML markup for your XPath Query parameter, you must create a custom view. You must log in as an administrator to use Microsoft Event Viewer.
XPath queries that use the WinCollect protocol the TimeCreated notation do not support filtering of events by a time range. Filtering events by a time range can lead to errors in collecting events.
- On your desktop, select .
- Type the following command:
- Click OK.
- If you are prompted, type the administrator password and press Enter.
- Click .
When you create a custom view, do not select a time range from the Logged list. The Logged list includes the TimeCreated element, which is not supported in XPath queries for the WinCollect protocol.
- In Event Level, select the check boxes for the severity of events that you want to include in your custom view.
- Select an event log source. You can select the source from the Event sources drop-down menu, or you can browse to a source from the Event logs drop-down menu.
- Type the event IDs to filter from the event or log source.
Use commas to separate IDs.The following list contains an individual ID and a range: 4133, 4511-4522
- From the Task Category list, select the categories to filter from the event or log source.
- From the Keywords list, select the keywords to filter from the event or log source.
- Type the user name to filter from the event or log source.
- Type the computer or computers to filter from the event or log source.
- Click the XML tab.
- Copy and paste the XML to the XPath Query field of your WinCollect log source configuration