Filtering Windows event log for text in Data field

In a Windows event log (Win 8.1), I want to filter a log file for a substring in the Data field. What's the easiest way to do this (preferably in the Event Viewer with a custom view)?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

You could try to achieve this with XML filters.

Advanced XML filtering in the Windows Event Viewer

If you're familiar with PowerShell, you can also try it that way.

BlearyEyeAuthor Commented:
I saw the first link when I was poking around. But I don't see how to filter Data for a substring.

I've used PowerShell enuf to be somewhat dangerous but I don't know how to do the query I'm looking for.
I'm sorry i was wrong with "Get-Event"... it should have been "Get-EventLog".


Sadly i couldn't get a substring to work with the XML Filter, but maybe the PowerShell way will work.

I have an Event with the word "NtpClient" in the Message field.

I used the following command to query ("Ntp" as a substring of NtpClient) from the System EventLog .
> Get-EventLog -LogName System -Message "*Ntp*"

Does that help you in any way?

If that is not what you were looking for, then please be more specific about what you would like to achieve.
Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

BlearyEyeAuthor Commented:
Sorry for the delay. The PS command helps. It truncates the message however, and only displays a limited number of columns. Any idea how to get everything?
I hadn't much this to go deeper, but this could help to get full information.
Get-EventLog -LogName System -Message "*Ntp*" | Format-List *
BlearyEyeAuthor Commented:
Yes, that does get the whole Data element, including newlines. (Oddly, Get-EventLog renames the elements so that Data becomes Message, EventRecordID becomes Index ...)

The format isn't very readable however. I'd like to be able to output it as a file to view in Excel. Outputting to CSV is tricky since the message data sometimes has newlines and outputting to XLS also seems difficult.

After some playing around, here's what seems to do the job for me:
Get-EventLog -LogName thelogname | select TimeGenerated, Index, EventId, Category, MachineName, EntryType, Message  | Out-GridView

Open in new window

GridView is limited but may be enough. It shows newlines fine. I can pre-select events of interest in GetEventLog and further filter & sort in GridView.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
BlearyEyeAuthor Commented:
i came to with the final answer, with help from others.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 8

From novice to tech pro — start learning today.