I'm trying to search through the windows event log for anything where the event data contains the string TCP Provider, error: 0 as part of a longer error message. To do this I created the code below:
<QueryList> <Query Id="0" Path="Application"> <Select Path="Application">*[System[Provider[@Name='MyDemo' or @Name='AnotherDemo'] and (Level=2 or Level=3)]][EventData[Data[contains(.,'TCP Provider, error: 0')]]]</Select> </Query> </QueryList>
However this is seen as an invalid query - I'm guessing the contains statement is not recognised (as it looks like a special version of the XPath syntax is being used here. Does anyone know if what I'm attempting is possible / how to go about doing this?
Thanks in advance,