Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Creating a custom view

Use the Microsoft Event Viewer to create custom views, which can filter events for severity, source, category, keywords, or specific users.

WinCollect sources can use XPath filters to capture specific events from your logs. To create the XML markup for your XPath Query parameter, you must create a custom view.

Note:

You must log in as an administrator to use Microsoft Event Viewer.
  1. Click Start > Run.
  2. Type the following command: Eventvwr.msc
  3. Click OK.
  4. If you are prompted, type the administrator password and press Enter.
  5. Click Action > Create Custom View.
    Tip:

    When you create a custom view, do not select a time range from the Logged list. The Logged list includes the TimeCreated element, which is not supported in XPath queries for the WinCollect protocol.

  6. In Event Level, select the severity of events that you want to include in your custom view.
  7. Select an event source from the Event sources menu, or browse to a source from the Event logs menu.
  8. Type the event IDs to filter from the event or log source.
    Tip:

    Use commas to separate IDs. The following list contains an individual ID and a range: 4133, 4511-4522

  9. From the Task Category list, select the categories to filter from the event or log source.
  10. From the Keywords list, select the keywords to filter from the event or log source.
  11. Type the username to filter from the event or log source.
  12. Type the computer or computers to filter from the event or log source.
  13. Click the XML tab.
  14. Create a Windows Event Source with an XPath Channel and paste the XPath into the UI.
    • Using more than 10 XPath queries can affect WinCollect performance, depending on the XPath and the number of events that are coming into each channel.
    • Filtering events by a time range can lead to errors in collecting events.