Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've got an application event log...let's call it "CustomApplicationLog"

I've also got an awesome application...let's call it "MyAwesomeApplication"

Assuming this application were to ever throw an can I use the XML query editor to search for an arbitrary string insite the event log message?

Below is the query generated for me after picking most of the things I wanted. I can't find any documentation on parsing this out myself though.

  <Query Id="0" Path="CustomApplicationLog">
    <Select Path="CustomApplicationLog">*[System[Provider[@Name='MyAwesomeApplication'] and (Level=2)]]</Select>
share|improve this question
  <Query Id="0" Path="CustomApplicationLog">
   <Select Path="CustomApplicationLog">*[System[Provider[@Name='MyAwesomeApplication'] and (Level=2)]] and *[EventData[Data and (Data='string i'm looking for')]]</Select>

This is assuming your custom application spits out the sting in the EventData section. It searches the entire Event Data section of the log for that string. To get a better idea, find the log you're looking for and check out the XML View.

share|improve this answer
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. – slm Apr 18 '13 at 12:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.