Event Log > Filter Current Log > XML > where EventData contains text

Solution 1:

On further investigation I came across an answer to this on Stack Overflow: https://stackoverflow.com/questions/8671194/using-xpath-starts-with-or-contains-functions-to-search-windows-event-logs

So it looks like it's not possible to do wildcard searches in the event log.

Solution 2:

You can always use a powershell script and pass the XML through powershell's where function (supports -contains -like -match):

nv.ps1

$Query = @"
  <QueryList>
    <Query Id="0" Path="System">
      <Select Path="System">
        *[System[(EventID=20001)]]
      </Select>
    </Query>
  </QueryList>
"@

$events = Get-WinEvent -FilterXml $Query
ForEach ($Event in $Events) {
    # Convert the event to XML
    $eventXML = [xml]$Event.ToXml()
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverVersion -Value $eventXML.Event.UserData.InstallDeviceID.DriverVersion
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  DriverDescription -Value $eventXML.Event.UserData.InstallDeviceID.DriverDescription
    Add-Member -InputObject $Event -MemberType NoteProperty -Force -Name  Data -Value $eventXML.Event.EventData.Data
}
$Events | Select TimeCreated, Id, DriverDescription, DriverVersion, ProviderName, @{Name="MessageData";Expression={$_.Message + $_.Data}} | Where {$_.DriverDescription -match "NVIDIA GeForce GTX*"} | Out-GridView
pause

A cmd to launch it (nv.cmd):

powershell.exe -executionpolicy bypass "& '.\nv.ps1'"