Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I've got an application event log...let's call it "CustomApplicationLog"

I've also got an awesome application...let's call it "MyAwesomeApplication"

Assuming this application were to ever throw an error...how can I use the XML query editor to search for an arbitrary string insite the event log message?

Below is the query generated for me after picking most of the things I wanted. I can't find any documentation on parsing this out myself though.

<QueryList>
  <Query Id="0" Path="CustomApplicationLog">
    <Select Path="CustomApplicationLog">*[System[Provider[@Name='MyAwesomeApplication'] and (Level=2)]]</Select>
  </Query>
</QueryList>
share|improve this question

1 Answer 1

<QueryList>
  <Query Id="0" Path="CustomApplicationLog">
   <Select Path="CustomApplicationLog">*[System[Provider[@Name='MyAwesomeApplication'] and (Level=2)]] and *[EventData[Data and (Data='string i'm looking for')]]</Select>
  </Query>
</QueryList>

This is assuming your custom application spits out the sting in the EventData section. It searches the entire Event Data section of the log for that string. To get a better idea, find the log you're looking for and check out the XML View.

share|improve this answer
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  slm Apr 18 '13 at 12:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.