Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Windows powershell you can type get-winevents without any parameters and it will dump all events. I would like access to all events in the event viewer using a custom view. I can of course just check off everything but this results in an xml query that is too big, so I'm trying to do wildcards for path rather than specify each path. I tried this:

  <Query Id="0" Path="Application">
    <Select Path="*">*[System[TimeCreated[timediff(@SystemTime) &lt;= 43200000]]]</Select>

But it errors on Path="*".

How can I make a custom view that shows all events? I found an MSDN article on consuming events that says you can use the wildcard but I guess I'm using it wrong. Thanks

share|improve this question
up vote 1 down vote accepted

You cannot "wildcard" the path - this one is required and must contain a certain event log. You only can use wildcards in the XPath expression for a given event log. In Addition, I remember there's a limit for the number of nodes you can have, but I don't recall what exactly it was...

There's a related post here:

share|improve this answer
Sadly it looks like this is the correct answer. How about everything in a root folder? The Microsoft folder holds most of the entries. Is there any way to specify the microsoft folder rather than Microsoft-something1, Microsoft-something2, etc. – test Aug 28 '13 at 0:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.