windows-event-log – 如何使用通配符过滤Windows事件日志？

根据文档 here,支持星号通配符,因此它应该在例如.

* [EventData [Data [@ Name =’TargetUserName’] =’User1 *’]]

但我不能让任何通配符过滤器工作 – 有没有人能够这样做？

XPath选择器必须以*开头,但是您不能使用*来过滤字段,因为Xpath 1.0没有包含运算符.

https://blogs.technet.microsoft.com/askds/2011/09/26/advanced-xml-filtering-in-the-windows-event-viewer/

XPath 1.0 Limitations:
Windows Event Log supports a subset of XPath 1.0. There are limitations to what functions work in the query. For instance,you can use the position,Band,and timediff functions within the query but other functions like starts-with and contains are not currently supported.