Quantcast
Viewing all articles
Browse latest Browse all 11372

Event log: supress events with event data equals to minus sign ('-')

Hello,

I have some events with IpAddress set to '-' and i want to suppress those events using a custom view. I try the following filter:

<QueryList>

  <Query Id="0" Path="Security">

    <Select Path="Security">*[System[(EventID=4625)]]</Select>

    <Suppress Path="Security">*[EventData[Data[@Name='IpAddress'] and (Data='-')]]</Suppress>

  </Query>

</QueryList>

This supresses all events because I believe this indicates a range that includes everything. Or maybe I'm wrong, however no events shows up in the view.

How can I suppress events with '-' in one of the event data properties?

Thanks a lot,

Boaz.


Viewing all articles
Browse latest Browse all 11372

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>